CVE-2026-42959

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.25.1

Description A denial of service issue exists in the DNSSEC validator. When constructing chase-reply messages for validation, the software uses an incorrect counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication can increase the ANSWER section count, while authority filtering can decrease the AUTHORITY section count, creating an uninitialized array slot. The validator subsequently dereferences this uninitialized pointer, leading to a process crash. An attacker controlling a DNSSEC-signed domain can trigger this by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records along with signed ADDITIONAL glue records.

Recommendations Update to version 1.25.1.