CVE-2026-42959 describes a denial of service vulnerability in NLnet Labs Unbound DNS resolver up to version 1.25.0. The flaw is due to improper calculation of write offsets for ADDITIONAL section rrsets in DNSSEC validation, caused by using the wrong counter. This leads to an uninitialized pointer dereference when a combination of DNAME duplication and authority filtering affects section counts. An attacker controlling a DNSSEC-signed domain can exploit this by sending a single specially crafted query with a DNAME chain containing unsigned CNAMEs and a response with unsigned AUTHORITY records alongside signed ADDITIONAL glue records, causing Unbound to crash. The issue is fixed in Unbound 1.25.1 by correcting the counter usage.

Successful exploitation results in a denial of service condition due to an immediate crash of the Unbound DNS resolver process. This disrupts DNS resolution services relying on the affected Unbound versions. There is no indication of privilege escalation, data disclosure, or remote code execution from the provided data.

A fix is available in Unbound version 1.25.1, which corrects the counter usage to prevent the uninitialized pointer dereference. Users should upgrade to version 1.25.1 or later to remediate this vulnerability. Patch status is not explicitly stated in the vendor advisory content provided but the description confirms the fix in 1.25.1. No additional mitigations are indicated.