CVE-2026-44621

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.25.2

Description Applications using libunbound configured with the unwanted-reply-threshold parameter may be abruptly terminated. This occurs when the threshold is reached and libunbound attempts to call the libworker alloc cleanup() function, which is missing from the function call allow list. The issue is triggered when the unwanted-reply-threshold is set to a non-zero value and the iterator queries an authoritative server that sends enough UDP datagrams with incorrect transaction IDs to exceed that threshold, resulting in a fatal exit of libunbound and the termination of the embedding application.

Recommendations Update to version 1.25.2 or later. As a temporary workaround, set the unwanted-reply-threshold parameter to zero.