CVE-2026-42944

Description

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploit Prediction

0.0051

Probability of exploitation

0.39%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-197 CWE-197

CWE-787 Out-of-bounds Write

Affected Products

Vendor	Product	Versions
nlnetlabs	unbound	1.14.0 — 1.25.1

References

Advisories & Patches

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt

Frequently Asked Questions

What is CVE-2026-42944? +

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2026-42944? +

CVE-2026-42944 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0051, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-42944? +

CVE-2026-42944 affects products from nlnetlabs, specifically: unbound. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-42944? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-6039

LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a …

CVE-2024-43639 9.8

Windows KDC Proxy Remote Code Execution Vulnerability

CVE-2025-6965 9.8

There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of …

CVE-2024-49018 8.8

SQL Server Native Client Remote Code Execution Vulnerability

CVE-2024-43519 8.8

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21352 8.8