CVE-2026-40691

In Unbound library versions 1.4.22 through 1.25.1, a vulnerability allows DNS cache poisoning attacks. The issue arises from deterministic assignment of UDP port ranges to worker threads when SO_REUSEPORT is enabled, enabling an attacker to predict the source port and reduce DNS transaction entropy.

NLnet Labs Unbound up to version 1.25.0 is vulnerable to cache poisoning via promiscuous records in the authority section. An attacker can inject non-NS records (e.g., MX) along with address records that Unbound caches, leading to cache poisoning. Version 1.25.1 includes a fix that disregards address records from the additional section if they are not explicitly relevant to NS records.

NLnet Labs Unbound from version 1.19.1 to 1.25.0 has a vulnerability in the DNSSEC validator due to a struct-assignment bug during deep copy, leading to a dangling pointer and potential code execution.

In Unbound 1.20.0 through 1.25.1, with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0', the discard-timeout logic fails to properly decrement a counter, leading to new clients being dropped and service degradation. An attacker can exploit this by querying a slow authoritative zone.

In NLnet Labs Unbound up to version 1.25.1, when building the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, the validator computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it directly to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. An attacker running a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk through stale bytes in the 'env->scratch_buffer', past the end of its heap allocation if 'msg-buffer-size' has been lowered. This leads to a heap buffer overflow.

In Unbound 1.22.0 through 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions) and crash the Unbound process using a single DoQ connection and one DNS query. This is due to passing an erroneous error value to libngtcp2.

In Unbound 1.7.0 through 1.25.1, when there are more DNSCrypt certificates than keys, Unbound fills leftover slots with '0xdb' bytes. An unauthenticated client sending a UDP datagram ≥68 bytes with first 8 bytes '0xdb' to the DNSCrypt port can crash the server.

In Unbound 1.10.0 through 1.25.1, with 'serve-expired: yes' and a 'response-ip' or 'rpz-cname-override' rule, a remote client controlling a delegated domain can crash the daemon. This is due to an inconsistency in the CNAME alias handling logic in serve-expired-client-timeout.

In Unbound from version 1.6.0 up to 1.25.1, the 'view_local_data' and 'view_local_datas' commands in 'unbound-control' create a bare local zone tree for a view without default-protected zones (e.g., RFC 1918 reverse, AS112, .onion, .localhost). This causes queries for these names to be forwarded to public DNS instead of being answered locally, bypassing local policy.

In NLnet Labs Unbound from 1.18.0 up to 1.25.1, when listening on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node validates for every PROXYv2-declared source behind that node. An off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks.