In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA… (CVE-2026-56416)

In NLnet Labs Unbound versions up to and including 1.25.1, the DNSSEC validator improperly handles multi-domain name resource records (PX, RP, MINFO, SOA) by computing the address of a second embedded domain name without verifying its presence. The wire-format parser accepts records where the RDATA ends after the first domain name, leading to a scenario where the function 'query_dname_tolower()' reads beyond the allocated heap buffer if the second domain name is absent. This results in a heap buffer overflow, with the impact depending on the contents of adjacent heap memory and the configured message buffer size.

The vulnerability can cause a heap buffer overflow in the Unbound DNS resolver during DNSSEC validation of specially crafted records served by an attacker-controlled DNSSEC-signed authoritative server. This may lead to memory corruption and potentially denial of service or other undefined behavior. The CVSS score of 4.8 reflects a medium severity with no confidentiality impact, low integrity impact, and high availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting exposure of vulnerable Unbound instances to untrusted DNS servers or networks. Monitor vendor communications for updates and apply patches promptly once released.