In NLnet Labs Unbound versions 1.23.0 up to and including 1.25.1, when the configuration option 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is processed incorrectly. The option's length is used as the length of the agent domain, but during domain name validation, the actual length is not enforced. If the agent domain is followed by extraneous bytes ('garbage'), these bytes are appended to the synthetic '_er.' report query name. When Unbound later processes this query name in the iterator via a subquery to send the DNS Error Report, it incorrectly strips labels beyond the embedded root, reading one byte past the intended boundary. This byte is then passed as a label length to 'dname_query_hash()', causing a stack variable ('labuf') to be overwritten. This vulnerability can be triggered by a single malicious upstream response from an attacker-controlled delegated zone, resulting in daemon termination (denial of service).

The vulnerability allows an unauthenticated attacker controlling an upstream delegated DNS zone to cause a denial of service by terminating the Unbound daemon. There is no indication of confidentiality or integrity impact. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and an impact limited to availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling 'dns-error-reporting' to avoid triggering the vulnerable code path. Monitor vendor communications for updates and official patches.