VulnSocial

CVE-2026-55973General(nlnetlabs / unbound)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch nlnetlabs unbound systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.

nlnetlabs CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • unbound

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-07-22); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
nlnetlabs
Products
unbound

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-07-22: 1Mentions · 2026-07-23: 1Mentions · 2026-07-28: 1Patch / Workaround · 2026-07-23: 1Patch / Workaround · 2026-07-28: 1Technical Details · 2026-07-22: 1Technical Details · 2026-07-23: 1Technical Details · 2026-07-28: 107-2207-2307-28
Signal classification3 categories
General
133.3%
Disclosure
133.3%
Patch
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-221
General1
2026-07-231
Disclosure1
2026-07-281
Patch1
Full discourse3 posts
  • Yasuhiro Morishita@OrangeMorishita
    General

    CVE-2026-14586 Medium DoS CVE-2026-32665 High DoS CVE-2026-40691 High DoS CVE-2026-41637 Low DoS CVE-2026-42955 Low CVE-2026-40622（幽霊ドメイン名）の追加修正 CVE-2026-44621 Medium DoS CVE-2026-44687 Low DoS（存在するドメイン名を存在しないと誤認させる） CVE-2026-44690 High キャッシュポイズニング CVE-2026-46582 Low キャッシュポイズニング CVE-2026-50045 Medium 外部へのDoS CVE-2026-50046 Medium DoS CVE-2026-50243 Medium DNSSEC検証のバイパス CVE-2026-50248 Medium DNSSEC Bogusでもゾーン転送の接続先にしてしまう CVE-2026-50251 Medium 外部からの意図的なキャッシュクリアによるDoS CVE-2026-50252 Medium UDPソースポートを外部から推測可能（キャッシュポイズニング） CVE-2026-52863 Medium DoS CVE-2026-54478 Low DNSクッキーの無力化 CVE-2026-55708 Low ローカルな名前を外部に問い合わせてしまう（情報流出） CVE-2026-55717 Medium DoS CVE-2026-55973 High DoS CVE-2026-55990 Medium DoS CVE-2026-55991 Medium DoS CVE-2026-56416 Medium DoS CVE-2026-56444 Medium DoS

    Post summary

    The text provides a simple disclosure of numerous CVE‑2026 entries with their severity and function, offering no indications of exploits, patches, or false positives.

    10040503
    4.6K followersView on X
  • Open Source Security mailing list@oss_security
    Patch

    Unbound 1.25.2 fixes many CVEs https://www.openwall.com/lists/oss-security/2026/07/22/7 4 "severity: HIGH" CVE-2026-32665: Remote DNS-over-QUIC DoS CVE-2026-40691: Packet of death for DNSCrypt over TCP CVE-2026-44690: Cross-zone wildcard cache poisoning CVE-2026-55973: Stack buffer overflow + many MEDIUM and LOW

    Post summary

    The post announces that Unbound version 1.25.2 addresses a set of high, medium, and low severity CVEs, including DoS, cache poisoning, and buffer overflow issues.

    00030421
    4.7K followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    #CVE-2026-55973 - Buffer Overflow in NLnet Labs Unbound 1.23.0-1.25.1. EDNS Report-Channel option mishandling leads to memory corruption. #CVSS 7.5. No patch yet. Disable dns-error-reporting immediately. #CVEAlert #infosec #DNSSEC #sysadmin #linux https://www.valtersit.com/cve/CVE-2026-55973/

    Post summary

    CVE-2026-55973 is a buffer overflow in Unbound 1.23.0‑1.25.1 that leads to memory corruption; no patch is available yet, so administrators should disable dns-error-reporting as a temporary measure.

    0000060
    989 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnlnetlabsunbound---

Explore more

Back to dashboardnlnetlabs CVEsunbound vulnerabilities