Signal is active with 1 mentions in latest observed window
Immediate actions
Patch nlnetlabs unbound systems immediately
Recommended action window: Monitor and triage in normal cycle
NVD description
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.
Unbound 1.25.1 fixes 11 CVEs https://www.openwall.com/lists/oss-security/2026/05/20/5
CVE-2026-33278: Remote code execution during DNSSEC validation
CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options
CVE-2026-42959: Crash during DNSSEC validation of malicious content
+8 more
Post summary
Unbound version 1.25.1 patches 11 CVEs, including key vulnerabilities like remote code execution during DNSSEC validation and heap overflows, with the fix now available.
・Fix CVE-2026-33278, Possible remote code execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-42944, Heap overflow and crash with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-42959, Crash during DNSSEC validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-32792, Packet of death with DNSCrypt. Thanks to Andrew Griffiths from ‘http://calif.io’ for the report.
・Fix CVE-2026-40622, “Ghost domain name” variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-41292, Parsing a long list of incoming EDNS options degrades performance. Thanks to GitHub user ‘N0zoM1z0’, also Qifan Zhang from Palo Alto Networks, for the report.
・Fix CVE-2026-42534, Jostle logic bypass degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-42923, Degradation of service with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-42960, Possible cache poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and JianJun Chen, Tsinghua University, for the report.
・Fix CVE-2026-44390, Unbounded name compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Post summary
The text lists multiple CVE fixes, highlighting patches and providing concise vulnerability type details; no PoC, exploit, or active exploitation is mentioned.
Warning: #NLnet Labs has addressed multiple vulnerabilities, #CVE-2026-33278; #CVE-2026-42944; #CVE-2026-42959. Successful exploitation could enable to denial of service #DoS, and potentially remote code execution #RCE! #Patch#Patch#Patch
Post summary
NLnet Labs has released patches for CVE-2026-33278, CVE-2026-42944, and CVE-2026-42959, warning that exploitation could enable DoS or RCE but confirming that fixes are available.
"This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42960, CVE-2026-44390 and CVE-2026-44608."
Post summary
The release notes announce that patches have been applied to address a list of CVEs, confirming that the vendor has addressed the associated vulnerabilities.
🧯 Unbound CVE-2026-42944 is the reminder: DNS isn’t “set and forget,” and crashes are just attackers’ favorite hobby. Even if Microsoft’s not at fault, Windows admins still get the pager.
https://windowsforum.com/threads/cve-2026-42944-unbound-dns-heap-overflow-fix-in-1-25-1-not-a-windows-dns-bug.420037/?utm_source=x&utm_medium=social&utm_campaign=news_node84
#HeapOverflow#DnsSecurity#UnboundDns#Cve202642944 https://t.co/vC5prCPtpy
Post summary
The tweet highlights CVE‑2026‑42944, a heap‑overflow bug in Unbound DNS, and points to a fix in version 1.25.1, without providing exploit details or evidence of active exploitation.
