Qifan Zhang

**Name of the Vulnerable Software and Affected Versions** NSD (affected versions not specified) **Description** On little-endian systems, the software incorrectly compares IP addresses with access control ranges. This occurs because IPv4 addresses are compared as unsigned 32-bit numbers using the host's endianness, while the comparison values remain in network byte order (big-endian). For IPv6 addresses, the process involves four separate unsigned 32-bit number comparisons, also failing to account for the difference between host endianness and network byte order. Consequently, IP addresses intended to be allowed may be denied, and those intended to be denied may be granted access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NSD (affected versions not specified) **Description** A remote client can cause a crash of the NSD serve child process in debugging or non-release build types. This occurs when the process receives a specially crafted message containing a specific number of DNS Cookie options, such as 17 options when the UDP payload size is 512. Repeatedly crashing these processes can severely degrade performance or lead to a complete denial of DNS service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Access control list items configured as BLOCKED to deny access on the proxy protocol port can be bypassed. This occurs when a connection is established over TCP or TLS and the query is sent twice on a connection that remains open. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Resource Record Signatures (RRSIGs) containing an insufficient number of labels can allow the bypass of DNSSEC wildcard validation. DNSSEC is a suite of extensions that add a layer of security to the Domain Name System (DNS) by attaching digital signatures to DNS records to verify their authenticity. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A DNSSEC validation bypass occurs when wildcard expansion proofs, specifically NSEC or NSEC3 records, are accepted without signature validation. This happens when the wildcard answer is a CNAME or DNAME record. DNSSEC (Domain Name System Security Extensions) is a suite of extensions that add a layer of security to the DNS protocol by enabling DNS responses to be digitally signed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.7.0 through 1.25.1 **Description** When the `dnscrypt:` clause contains more `dnscrypt-provider-cert:` files than matching `dnscrypt-secret-key:` files, the software fails to properly initialize all slots, leaving some filled with `0xdb` bytes from the libsodium allocator. Because the system iterates based on the number of certificate files rather than actual initialized slots, it may access these garbage entries. An unauthenticated client can trigger a server crash by sending a UDP datagram of 68 bytes or more to the `dnscrypt-port` where the first 8 bytes are `0xdb`, leading to a garbage dereference. This issue requires the software to be compiled with DNSCrypt support using the `--enable-dnscrypt` flag. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. Ensure that the number of `dnscrypt-provider-cert:` files does not exceed the number of `dnscrypt-secret-key:` files in the `dnscrypt:` configuration clause.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.10.0 through 1.25.1 **Description** A remote client controlling a delegated domain can cause the daemon to crash, leading to a denial of service. This occurs when the `serve-expired: yes` setting is enabled alongside a `response-ip: <net> redirect` or `response-ip-data: <net> CNAME <target>` rule, or the equivalent `rpz-cname-override`. The issue stems from the `serve-expired-client-timeout()` function, which executes a two-pass loop to follow a CNAME alias generated by response-ip. During the second pass, the function resets the `alias rrset` variable but fails to reset `partial rep`, resulting in a NULL pointer dereference. An attacker can trigger this by controlling a zone that returns an A/AAAA record within the configured response-ip/rpz subnet and delaying the response after the previous record has expired. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, disable the `serve-expired: yes` setting or restrict the use of `response-ip` and `rpz-cname-override` rules.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.22.0 through 1.25.1 **Description** A remote unauthenticated client can terminate the entire resolver process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This occurs when `ngtcp2 conn writev stream()` returns `NGTCP2 ERR STREAM DATA BLOCKED`, leading Unbound to call `ngtcp2 ccerr set application error()` with a `-1` error value. This value is implicitly converted to `0xFFFFFFFFFFFFFFFF`, which exceeds the 62-bit variable-length integer ceiling during serialization in `ngtcp2 conn write connection close()`. Consequently, `ngtcp2 put uvarintlen()` fails an assertion, causing the process to abort. An attacker can trigger this by advertising `initial max stream data bidi local = 1` in transport parameters and sending a DoQ query without reading the stream. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.6.0 through 1.25.1 **Description** A flaw exists where a replay of a wildcard rrset (Resource Record Set) can be briefly marked as DNSSEC secure based solely on RRSIG (Resource Record Signature) validation and stored in the cache before NSEC (Next Secure) validation identifies it as bogus. This occurs when a resolving thread marks an rrset as secure and another thread on the serve expired path retrieves these updated contents for a reply. An attacker can exploit this to change a specific record adjacent to a wildcard into that wildcard. This is achieved by using a DNSSEC-signed domain and a CNAME wrapper record pointing to a record next to a wildcard. By querying for the wildcard sibling record and later injecting a wildcard replay into a response for the CNAME wrapper after expiry, the poisoned rrset is marked secure and points to the wildcard. This issue specifically affects the serve expired path and requires the injection of a signed wildcard rrset without the accompanying NSEC rrset. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.7.0 through 1.25.1 **Description** Insufficient validation of the `RRSIG.Labels` field and premature cache writes during RFC 8198 aggressive NSEC processing enable cache poisoning. An attacker controlling a single delegated zone under an NSEC-signed parent domain can poison arbitrary sibling zones. By using fraudulent wildcard DS records with fewer labels than expected or an unknown algorithm, the attacker can create insecure existence for non-existent delegations covered by the parent's NSEC chain, allowing the injection of insecure wildcard records for those delegations. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.6.2 through 1.25.1 **Description** When configured with the `respip` module before the validator, along with a `response-ip` redirect rule or an RPZ file using an RPZ-IP trigger, the rewriting handler fails to verify the security status of the upstream answer. This allows the system to rewrite a BOGUS A/AAAA answer to an operator-configured IP. If the validator detects an expired or invalid RRSIG (Resource Record Signature) on an answer within a `response-ip` or RPZ configuration, the answer is rewritten and assigned a hard-coded security level of INSECURE. Consequently, clients receive an INSECURE NOERROR reply. An attacker can exploit this by spoofing a BOGUS A/AAAA answer that falls within the configured subnet rewrites, causing DNSSEC protected answers to be insecurely redirected to the operator's target. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, restrict the use of the `respip` module or avoid using `response-ip` redirect rules and RPZ-IP triggers until the software is updated.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions prior to 1.25.2 **Description** When the `unwanted-reply-threshold` is enabled and set to a value greater than zero, the software is susceptible to a cache clearing attack. A malicious actor controlling a delegation that returns in-bailiwick glue records of 0.0.0.0/::0 can trigger a defensive cache clear of the message and rrset caches. This occurs because the system may route traffic for 0.0.0.0/::0 via loopback, causing the listener to answer from 127.0.0.1. The mismatch between the source IP 0.0.0.0 and the reply IP 127.0.0.1 leads the software to categorize the reply as unwanted. By repeatedly triggering this behavior, an attacker can force the `unwanted-reply-threshold` counter to its limit, clearing the cache indefinitely without needing to send spoofed packets. **Recommendations** Update to version 1.25.2 or later. As a temporary mitigation, set the `unwanted-reply-threshold` to zero to disable the affected functionality.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.7.0 through 1.25.1 **Description** An issue exists where an auth/rpz zone with a configured primary hostname that resolves to BOGUS A/AAAA records is still treated as a potential XFR endpoint. XFR (Zone Transfer) is a mechanism used to replicate DNS zone data from a primary server to a secondary server. A malicious actor capable of spoofing the hostname's A/AAAA record, without needing a valid RRSIG, can assume the role of the zone's XFR primary and replace the entire zone or the resolver's complete response policy. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.23.0 through 1.25.1 **Description** When the `dns-error-reporting: yes` setting is enabled, the software incorrectly processes the EDNS Report-Channel option (code 18) from upstream responses. Specifically, it uses the option's length as the length of the agent domain but fails to use the returned length during domain name checks. If the agent domain is followed by garbage data, these bytes are appended to the synthetic ` er.` report query name. During the execution of the `find closest of type()` function, the software strips labels using the query name length instead of stopping at the embedded root. This causes the process to walk one byte past the root and pass the first garbage byte to the `dname query hash()` function as a label length, resulting in a stack buffer overflow of the `labuf` variable. An attacker controlling a delegated zone can trigger this by sending a specially crafted upstream response, which is sufficient to terminate the daemon. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, set `dns-error-reporting` to `no` to disable the affected functionality.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.15.0 through 1.25.1 **Description** A use-after-free issue exists in the handling of DNS-over-TLS (DoT) forwarded queries. The TLS server name is tied to the lifetime of the `serviced query` struct but is also referenced by the `waiting tcp` struct. If the `serviced query` struct is removed from the mesh while the DoT TCP stream is still handshaking, the storage for the referenced string is freed. A subsequent error in the TLS stream leads to a read-only dereference of the freed pointer, causing a daemon crash and resulting in a denial of service. This can be triggered by a malicious actor querying records in a specific zone while placing the system under pressure to trigger the jostle logic. This requires a stub or forward zone configured for DoT with a `#authname` suffix on the server identification, and a transient connectivity failure to the server. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1.

**Name of the Vulnerable Software and Affected Versions** Unbound versions 1.9.0 through 1.25.1 **Description** A heap-based buffer overflow occurs when a DNSCrypt query is received over TCP. The routine responsible for encrypting the reply in place does not bound the reply length against the destination buffer size, failing to apply the size clamp used in the UDP path. Consequently, a reply exceeding 65504 bytes is shifted forward by 48 bytes within a buffer of capacity `msg-buffer-size`, resulting in a write operation past the end of the heap allocation. This can be triggered by a single malicious encrypted query, causing the resolver to crash and leading to a denial of service. This issue requires the software to be compiled with DNSCrypt support via `--enable-dnscrypt` and the `dnscrypt:` clause to be configured and enabled for listening interfaces. **Recommendations** Update Unbound to a version later than 1.25.1. As a temporary mitigation, disable the `dnscrypt:` clause on listening interfaces or avoid compiling the software with the `--enable-dnscrypt` option.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.22.0 through 1.25.1 **Description** A memory-accounting bypass exists in the downstream DNS-over-QUIC (DoQ) implementation. When DoQ is enabled, the first two bidirectional streams on a new QUIC connection (stream id 0 and 4) bypass the per-stream `quic-size` gate. Large input buffers are allocated after the 2-byte length prefix is received from these initial streams, allowing a remote client to exceed the configured `quic-size` limit with minimal input. By sending a declared 65535-byte length prefix and keeping the streams open, a client can cause the system to allocate approximately double that amount, leading to a denial of service for new DoQ clients. This issue requires the software to be compiled with DoQ support using `--with-libngtcp2` and the `quic-port` to be configured for listening interfaces. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, disable the `quic-port` configuration on listening interfaces or avoid using the DoQ implementation if compiled with `--with-libngtcp2`.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions prior to 1.25.2 **Description** Applications using `libunbound` configured with the `unwanted-reply-threshold` parameter may be abruptly terminated. This occurs when the threshold is reached and `libunbound` attempts to call the `libworker alloc cleanup()` function, which is missing from the function call allow list. The issue is triggered when the `unwanted-reply-threshold` is set to a non-zero value and the iterator queries an authoritative server that sends enough UDP datagrams with incorrect transaction IDs to exceed that threshold, resulting in a fatal exit of `libunbound` and the termination of the embedding application. **Recommendations** Update to version 1.25.2 or later. As a temporary workaround, set the `unwanted-reply-threshold` parameter to zero.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.22.0 through 1.25.1 **Description** Client terminated DNS-over-QUIC (DoQ) queries are not accounted for properly, leading to an inflation of the waiting number of replies for in-flight resolution queries. This causes a degradation of resolution services for new clients. An attacker can trigger this by issuing DoQ queries and immediately terminating them using STOP SENDING, RESET STREAM, or CONNECTION CLOSE QUIC frames. Once the maximum limit is reached, new queries for in-flight resolutions are silently dropped. This issue requires the software to be compiled with DoQ support via `--with-libngtcp2` and the `quic-port` to be configured. Additionally, the attacker must use multiple source IPs to bypass the `wait-limit` option. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.13.2 through 1.25.1 **Description** An off-by-one error exists in the `harden-below-nxdomain` logic, which is enabled by default. This issue occurs when stub or forward zones are located below an intermediate label that is itself below a DNSSEC signed zone. The `harden-below-nxdomain` feature performs an upward DNS cache walk with a delegation point guard intended to prevent NXDOMAIN synthesis above stub or forward zones. However, because the guard tests the domain name before stripping a label, it allows an iteration where the domain name matches the configured stub or forward zone apex. The process then strips one more label and probes the cache of the apex's immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, the walk returns it, causing the configured stub or forward upstream to be bypassed and never contacted. This behavior is triggered by a query for the intermediate label between the stub or forward apex and the DNSSEC parent zone. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, consider disabling the `harden-below-nxdomain` logic.