In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the… (CVE-2026-55973)

In NLnet Labs Unbound versions 1.23.0 up to and including 1.25.1, enabling 'dns-error-reporting: yes' causes the EDNS Report-Channel option (code 18) from the last upstream response to be improperly processed. The option's length is used as the length of the agent domain, but during domain name validation, the actual returned length is ignored. If the agent domain is followed by extraneous bytes, these are appended to the synthetic '_er.' report query name. When Unbound processes this query name in the iterator via a subquery, it incorrectly strips labels using the query name length rather than stopping at the embedded root. This leads to reading one byte past the root and passing a garbage byte as a label length to 'dname_query_hash()', which overwrites the stack variable 'labuf'. This flaw allows a single upstream response from a delegated zone controlled by an attacker to cause the Unbound daemon to terminate, resulting in denial of service.

The vulnerability causes the Unbound DNS resolver daemon to terminate unexpectedly when processing specially crafted upstream DNS responses with the EDNS Report-Channel option. This results in a denial of service condition, potentially disrupting DNS resolution services relying on the affected Unbound versions with 'dns-error-reporting' enabled. There is no indication of confidentiality or integrity impact.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling 'dns-error-reporting' to avoid triggering the vulnerability.