Description
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.
Published: 2026-07-22
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a stack buffer overflow that occurs in Unbound 1.23.0 through 1.25.1 when the configuration parameter dns‑error‑reporting is set to yes. The overflow is triggered by malicious EDNS Report‑Channel options sent by an upstream server, allowing an attacker to corrupt internal memory during a domain name check and terminate the Unbound daemon. The flaw corresponds to CWE‑20, reflecting insufficient input validation.

Affected Systems

NLnet Labs Unbound versions from 1.23.0 up to and including 1.25.1 are affected. The issue was fixed starting with version 1.25.2.

Risk and Exploitability

The CVSS score of 7.5 indicates a high risk of denial of service. The EPSS score is < 1%, showing a very low probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting it is not currently known to be exploited in the wild. Exploitation requires a malicious or compromised upstream DNS server that can send a crafted EDNS Report‑Channel option; from a remote attacker’s perspective this means the attacker must control the delegated zone or otherwise influence the upstream response. Successful exploitation results in a stack corruption that terminates the daemon, leading to denial of service for all queries processed by the Unbound instance.

Generated by OpenCVE AI on August 3, 2026 at 23:45 UTC.

Remediation

Vendor Solution

This issue is fixed starting with version 1.25.2

OpenCVE Recommended Actions

  • Upgrade NLnet Labs Unbound to version 1.25.2 or later to apply the official fix.
  • If an immediate upgrade is not possible, modify the configuration file to set dns‑error‑reporting: no, disabling the processing of the problematic EDNS option.
  • Apply network‑level filtering to block or strip EDNS Report‑Channel options (code 18) from upstream responses, or restrict upstream DNS traffic to trusted, non‑malicious servers.
  • Monitor Unbound logs for abnormal EDNS REPORT‑CHANNEL activity and check for signs of a denial‑of‑service event.

Generated by OpenCVE AI on August 3, 2026 at 23:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Nlnetlabs
Nlnetlabs unbound
Vendors & Products Nlnetlabs
Nlnetlabs unbound

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-805
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 22 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Description In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.
Title 'dns-error-reporting: yes' leads to stack buffer overflow
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nlnetlabs Unbound
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-07-22T14:06:00.025Z

Reserved: 2026-06-22T12:27:22.820Z

Link: CVE-2026-55973

cve-icon Vulnrichment

Updated: 2026-07-22T14:05:54.165Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T14:17:21.663

Modified: 2026-07-24T14:24:21.837

Link: CVE-2026-55973

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-22T00:00:00Z

Links: CVE-2026-55973 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:00:09Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-805

    Buffer Access with Incorrect Length Value