CVE-2026-42944 is a heap overflow vulnerability in NLnet Labs Unbound DNS resolver affecting versions 1.14.0 up to and including 1.25.0. The flaw arises from a numeric truncation error in the calculation of the size of EDNS fields when encoding multiple NSID, DNS Cookie EDNS, and EDNS Padding options in the reply packet. When these options ('nsid', 'answer-cookie', 'pad-responses') are enabled, an attacker capable of sending queries with multiple such EDNS options can exploit this truncation to overflow the heap with attacker-controlled data, leading to a crash. The vulnerability is fixed in Unbound version 1.25.1 by implementing de-duplication of EDNS options and correcting the size calculation to prevent truncation and overflow.

Successful exploitation allows an unauthenticated attacker who can send DNS queries to cause a heap overflow in Unbound, resulting in a denial of service (crash). The vulnerability does not require privileges or user interaction and can be triggered remotely. There is no confirmed exploitation in the wild. The CVSS v4.0 base score is 8.7 (high severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and high impact on availability.

A fixed version, Unbound 1.25.1, is available which addresses the vulnerability by de-duplicating EDNS options and fixing the size calculation to prevent truncation and heap overflow. Users should upgrade to version 1.25.1 or later. Red Hat has issued security advisories and updates for affected Red Hat Enterprise Linux 10 packages that include this fix. Applying these vendor-provided updates is the recommended remediation. No additional mitigations are specified or required beyond applying the official patch.