A malformed domain name of 255 characters combined with a large TCP response can cause a heap buffer overflow while Unbound canonicalizes the RRSet. The missing buffer length check for the first owner name allows an attacker to overflow memory, potentially leading to code execution, denial of service, or other compromise of confidentiality and integrity on the affected system. The weakness is related to unchecked memory bounds (CWE-120/122).

NLnet Labs Unbound versions up to and including 1.26.0 are vulnerable. 1.26.1. Users running any Unbound instance not yet updated to the fixed release are at risk.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% reflects a very low exploitation probability. The flaw can be triggered by sending a crafted DNS response over TCP to a Unbound resolver that contains a 255-character name and a large RRSet. An attacker controlling a malicious name server or tampering with the incoming response can cause a heap buffer overflow during RRSet canonicalisation, before DNSSEC validation occurs. The vulnerability is not listed in the CISA KEV catalog, but the low EPSS suggests that real‑world exploitation is unlikely at present. Nevertheless, environments that accept traffic from untrusted zones should consider the risk and apply the vendor‑supplied patch.