NLnet Labs Unbound versions 1.22.0 through 1.26.1 contain a use-after-free vulnerability in the DNS-over-QUIC (DoQ) implementation. This flaw occurs during multi-threaded operation when a client-triggered QUIC path migration causes cleanup of a DoQ stream while a mesh reply still holds a pointer to it. The subsequent dereference of this freed pointer leads to a crash, impacting availability.
NLnet Labs Unbound versions prior to 1.26.2 have a vulnerability where excessive chained compression pointers in DNS messages can cause high CPU usage. This occurs because Unbound limits compression-pointer traversal per domain-name operation but lacks an aggregate inbound decompression-work budget. An attacker with recursive-query access and control over a delegated authority can exploit this to degrade Unbound's performance. The vulnerability has a medium severity with a CVSS score of 5.3 and does not impact confidentiality or integrity, only availability.
CVE-2026-50106 is a vulnerability in NLnet Labs Unbound up to version 1.26.1 involving reliance on untrusted inputs in security decisions. When configured with both a root trust anchor and an additional trust-anchor for an island-of-security zone whose parent is insecure, an attacker can deliver a forged NXDOMAIN response that causes Unbound to treat records in the trust island as insecure, denying their existence. This can lead to denial of service for DNS records within the affected trust island.
CVE-2026-35501 is a vulnerability in NLnet Labs Unbound versions 1.0.1 through 1.26.1 where improper validation of DNSSEC integrity check values can cause the DNSSEC validator to incorrectly treat a configured trust island as insecure. This occurs when Unbound is configured with both a root trust anchor and an additional trust-anchor for an island-of-security zone whose parent is insecure. A malicious actor can exploit this by sending a forged NSEC reply with the SOA bit cleared, causing Unbound to accept and cache the insecure response without proper RRSIG validation.
CVE-2026-109125 is a cache side-channel vulnerability in NLnet Labs Unbound up to version 1.26.1. It arises when the 'unwanted-reply-threshold' configuration is set above zero, which is not the default. An attacker can observe cache clearing behavior triggered by unwanted UDP replies with mismatched TXIDs, allowing inference of the upstream source port. This side-channel can facilitate source port filtering and TXID guessing, potentially enabling cache poisoning attacks. The vulnerability has a medium severity with a CVSS score of 5.3. It is not exploitable under default configurations and is unreliable on public resolvers with high threshold values. No official patch or fix is explicitly stated in the provided data.
CVE-2026-101341 is a high-severity stack-based buffer overflow vulnerability in NLnet Labs NSD affecting versions 4.10.0 up to but not including 4.15.3. The flaw arises because tokens of text in RDATA, such as in TXT records under 32 bytes, are not properly checked against the reserved space, allowing out-of-bounds stack writes. This can overwrite a callback function pointer that NSD calls immediately after parsing. The vulnerability requires feeding specially crafted zone files directly to NSD, such as those from an operator-controlled provisioning system, rather than those written out by NSD itself.
CVE-2026-101339 is a high-severity stack-based buffer overflow vulnerability in NLnet Labs NSD affecting versions from 4.10.0 up to but not including 4.15.3. It occurs when a HIP resource record with a near-limit RDATA size and an additional dname RDATA field (HIP Rendezvous server) is processed, allowing up to 191 bytes of attacker-controlled data to overwrite the stack. This vulnerability requires feeding a specially crafted zone file directly to NSD, such as from an operator-controlled provisioning system. Zone files written out by NSD itself are not vulnerable to this formatting issue.
CVE-2026-101338 is a high-severity stack-based buffer overflow vulnerability in NLnet Labs NSD affecting versions from 4.10.0 up to but not including 4.15.3. The flaw occurs when a SVCB or HTTPS resource record (RR) fills the wire format RDATA to its limit, allowing an additional ECH parameter to overwrite the stack. This can lead to the base64 decoder writing attacker-controlled data of unlimited size, potentially causing memory corruption. Zone files written out by NSD itself are not affected, but zone files fed directly to NSD, such as those from operator-controlled provisioning systems, can trigger the vulnerability.
CVE-2026-101337 is a high-severity stack-based buffer overflow vulnerability in NLnet Labs NSD affecting versions from 4.10.0 up to but not including 4.15.3. The flaw occurs when base64 data is split into pieces of 3 characters or less, causing incorrect token calculations that result in zero bytes and allow an attacker to overwrite the stack with up to 64K of controlled data. This vulnerability requires feeding a specially crafted zone file directly to NSD, such as from an operator-controlled provisioning system, rather than zone files generated by NSD itself.
CVE-2026-85501 affects NLnet Labs Unbound DNS resolver up to version 1.26.0 and involves allocation of resources without limits or throttling, leading to potential service degradation. The vulnerability arises from algorithmic complexity attacks on DNSSEC validation, including multiple attack vectors such as TagTrap, DelegationTrap, NsecTrap, and AdditionalTrap. These exploit excessive or malformed DNSSEC-related records to cause high computational overhead and resource exhaustion. The CVSS score is 5.3, indicating a medium severity impact primarily on availability. No known exploits are reported in the wild. No official patch or vendor advisory is provided in the input data, so patch status is not confirmed.
CVE-2026-80225 is a medium severity denial-of-service vulnerability in NLnet Labs Unbound up to version 1.26.0. It arises from allocation of resources without limits or throttling during TCP/DoT reading, allowing an attacker to monopolize a worker's event loop by streaming many distinct uncached DNS names. This causes service degradation but does not affect confidentiality or integrity.
NLnet Labs Unbound versions 1.20.0 through 1.26.0 contain a vulnerability in the 'serve-expired' code path that allows a double decrement of the 'wait-limit' counter per client IP. This flaw can be exploited by an attacker controlling an authoritative zone with short TTLs to bypass a DNS query rate-limiting countermeasure introduced for DNSBomb (CVE-2024-33655). The attacker can maintain the per-client counter at or below the configured limit indefinitely, allowing an arbitrary number of pending queries from a single source IP. The vulnerability has a CVSS score of 3.7 and is classified as medium severity.
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.
NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.
In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.
CVE-2026-19538 is an authentication bypass vulnerability in NLnet Labs NSD version 4.8.0. The issue allows attackers to bypass BLOCKED access control list items on the proxy protocol port by connecting over TCP or TLS and sending the query twice on a kept-open connection. This flaw can lead to unauthorized access despite intended access restrictions.
CVE-2026-19401 is a high-severity vulnerability in NLnet Labs NSD version 4.3.7 where a remote attacker can crash a server child process by sending a specially crafted DNS message containing a specific number of DNS Cookie options. This causes a reachable assertion failure in debugging or non-release builds, potentially leading to denial of DNS service if exploited repeatedly.