CVE-2026-44621: NLnet Labs Unbound libunbound DoS Flaw

CVE-2026-44621 Overview

CVE-2026-44621 is a denial of service vulnerability in NLnet Labs Unbound up to and including version 1.25.1. The flaw affects applications that link against libunbound and configure the unwanted-reply-threshold option to any non-zero value. When the iterator queries an authoritative server that returns enough wrong-transaction-ID UDP datagrams to cross the threshold, libworker_alloc_cleanup is invoked. This function is missing from the function call allow list, which triggers a fatal exit of libunbound and terminates the embedding application. Standalone Unbound is not affected because its equivalent function worker_alloc_cleanup is registered on the allow list.

Critical Impact
Remote attackers controlling or spoofing responses from an authoritative DNS server can abruptly terminate any application embedding libunbound with unwanted-reply-threshold enabled.

Affected Products

NLnet Labs Unbound libunbound library, versions up to and including 1.25.1
Applications embedding libunbound with unwanted-reply-threshold configured to a non-zero value
Standalone Unbound resolver is NOT affected

Discovery Timeline

2026-07-22 - CVE CVE-2026-44621 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-44621

Vulnerability Analysis

The vulnerability is an improper check for unusual or exceptional conditions [CWE-754] in the libunbound library. The library enforces a function call allow list that restricts which internal cleanup routines may execute in the embedded worker context. When the unwanted-reply-threshold mechanism triggers a cache flush, libunbound calls libworker_alloc_cleanup. This function was not added to the allow list, so the safety check treats the invocation as an unexpected condition and forces a fatal exit. The embedding application is terminated as a result. The equivalent path in standalone Unbound uses worker_alloc_cleanup, which is properly registered, so the standalone daemon executes the documented cache flush without issue.

Root Cause

The root cause is a missing entry in the libunbound function call allow list. The developers registered worker_alloc_cleanup for the standalone daemon but omitted the libworker_alloc_cleanup variant used by the embedded library build. When the unwanted reply threshold is reached, the guard rejects the call and aborts the process.

Attack Vector

An attacker who controls or can spoof responses from an authoritative DNS server queried by a target resolver can send a sustained volume of UDP responses containing incorrect transaction IDs. Once the count exceeds the configured unwanted-reply-threshold, libunbound invokes the disallowed cleanup function and the host application terminates. The attack requires network access and moderately favorable conditions to sustain the wrong-ID datagram flow, but it requires no authentication or user interaction. Exploitation results in loss of availability for the DNS resolution service and any dependent application logic.

No public proof-of-concept code is available. See the NLnet Labs CVE-2026-44621 Vulnerability Report for authoritative technical details.

Detection Methods for CVE-2026-44621

Indicators of Compromise

Unexpected termination or crash of applications embedding libunbound, correlated with recent DNS query activity.
Log entries or core dumps referencing libworker_alloc_cleanup or fatal exit messages from libunbound.
Elevated volumes of UDP DNS responses with mismatched transaction IDs directed at the resolver.

Detection Strategies

Monitor process supervisors and init systems for abnormal exit codes from services that embed libunbound.
Inspect authoritative-server response traffic for high rates of transaction-ID mismatches against outstanding queries.
Alert when the unwanted-reply-threshold counter approaches its configured limit in application telemetry.

Monitoring Recommendations

Enable verbose logging in applications linked with libunbound to capture the fatal exit message when it occurs.
Track DNS query and response pair correlation metrics at network egress to identify spoofing or injection activity.
Aggregate service restart events for resolver-dependent applications in a central log platform for trend analysis.

How to Mitigate CVE-2026-44621

Immediate Actions Required

Identify all applications that link against libunbound and review whether unwanted-reply-threshold is set to a non-zero value.
Upgrade libunbound to a fixed release as published by NLnet Labs once available; consult the vendor advisory for the exact patched version.
Restrict outbound DNS to trusted resolvers and authoritative servers to reduce exposure to spoofed UDP responses.

Patch Information

Refer to the NLnet Labs CVE-2026-44621 Vulnerability Report for the fixed version and upgrade instructions. The fix adds libworker_alloc_cleanup to the libunbound function call allow list so the cache flush completes without a fatal exit.

Workarounds

Set unwanted-reply-threshold to 0 in the libunbound configuration to disable the code path that triggers the fatal exit.
Front the embedding application with the standalone Unbound daemon, which is not affected, until the library patch can be deployed.
Deploy DNS response rate limiting and source validation at the network edge to reduce the volume of wrong-transaction-ID datagrams reaching the resolver.

bash

# Configuration example: disable the affected code path in libunbound
# In the unbound configuration consumed by the embedding application:
server:
    unwanted-reply-threshold: 0