CVE-2026-55973: NLnet Labs Unbound DoS Vulnerability

CVE-2026-55973 Overview

CVE-2026-55973 is a stack memory corruption vulnerability in NLnet Labs Unbound, an open-source recursive DNS resolver. The flaw affects versions 1.23.0 through 1.25.1 when the dns-error-reporting: yes option is enabled. When Unbound processes an EDNS Report-Channel option (code 18) from an upstream response, it mishandles the length field of the agent domain. An attacker controlling a delegated zone can return a single crafted response that terminates the daemon, causing denial of service against the resolver [CWE-20].

Critical Impact
A single upstream DNS response from an attacker-controlled delegated zone terminates the Unbound daemon, disrupting recursive DNS resolution for all downstream clients.

Affected Products

NLnet Labs Unbound 1.23.0
NLnet Labs Unbound 1.24.x
NLnet Labs Unbound up to and including 1.25.1 (when dns-error-reporting: yes)

Discovery Timeline

2026-07-22 - CVE-2026-55973 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-55973

Vulnerability Analysis

The vulnerability resides in Unbound's DNS Error Reporting (DNS-ER) code path, which is enabled by setting dns-error-reporting: yes in the configuration. When an upstream response contains the EDNS Report-Channel option (option code 18), Unbound reads the option payload to extract the agent domain name that identifies where error reports should be sent. The option length is used to bound the agent domain, but subsequent processing does not consistently respect that length.

During domain name validation, the code checks the agent domain but discards the length returned by the check. If the agent domain is followed by trailing bytes within the option payload, those bytes are appended to the tail of a synthetic report query name prefixed with _er.. The synthetic name is later handed to the iterator, which issues a subquery to send the error report upstream.

When Unbound processes this query name inside find_closest_of_type(), it strips labels using the total query name length rather than stopping at the embedded root label. The label walker steps one byte past the terminating root, then reads a garbage byte as if it were a label length. That value is passed to dname_query_hash(), which writes past the stack buffer labuf, corrupting the stack frame and crashing the daemon.

Root Cause

The root cause is improper input validation of length-delimited data within an EDNS option. The parser trusts the encoded structure of the agent domain but fails to enforce the option's declared length across all downstream consumers. This inconsistency between the length used during validation and the length used during label traversal is the source of the out-of-bounds read and stack write.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker delegates a zone under their control and waits for or induces a target resolver to query a name within that zone. The authoritative response carries a malformed EDNS Report-Channel option whose agent domain is followed by attacker-chosen trailing bytes. On receipt, the vulnerable Unbound instance parses the option, builds the _er. subquery, and crashes when the iterator processes the malformed name.

See the NLNet Labs CVE-2026-55973 Advisory for the vendor's technical description.

Detection Methods for CVE-2026-55973

Indicators of Compromise

Unexpected termination or segmentation faults of the unbound process, particularly with stack corruption signatures in core dumps referencing find_closest_of_type() or dname_query_hash().
Recursive resolution outages coinciding with queries to attacker-delegated zones.
Presence of EDNS Report-Channel options (option code 18) in upstream responses from untrusted authoritative servers.

Detection Strategies

Monitor Unbound service logs and systemd journal entries for repeated daemon restarts, abnormal exit codes, or watchdog-triggered restarts.
Inspect passive DNS or packet captures for EDNS option code 18 payloads that appear malformed or contain trailing bytes beyond the encoded agent domain.
Correlate resolver crashes with the last upstream query name to identify the delegated zone used as the trigger.

Monitoring Recommendations

Alert on any crash of the Unbound process and capture core dumps for forensic analysis.
Track the configuration state of dns-error-reporting across resolver fleets and flag hosts where it is enabled on vulnerable versions.
Ingest resolver logs into a centralized analytics platform to detect crash patterns across multiple recursive servers simultaneously.

How to Mitigate CVE-2026-55973

Immediate Actions Required

Upgrade NLnet Labs Unbound to a fixed release published after 1.25.1 as listed in the vendor advisory.
If patching cannot be performed immediately, disable DNS Error Reporting by setting dns-error-reporting: no in unbound.conf and reloading the service.
Restrict recursion to trusted client networks to reduce the attack surface for unauthenticated remote triggers.

Patch Information

Refer to the NLNet Labs CVE-2026-55973 Advisory for the fixed version numbers and upgrade guidance. The patch corrects the length handling in the EDNS Report-Channel parsing path so that trailing bytes after the agent domain cannot leak into the synthetic _er. query name.

Workarounds

Set dns-error-reporting: no in the Unbound configuration to disable the vulnerable code path entirely.
Deploy resolver monitoring with automatic restart to limit outage duration until patched builds are rolled out.
Where feasible, place recursive resolvers behind DNS filtering that strips unknown or unnecessary EDNS options from upstream responses.

bash

# Configuration example: disable DNS Error Reporting on vulnerable Unbound versions
# /etc/unbound/unbound.conf
server:
    dns-error-reporting: no

# Apply the change
sudo unbound-checkconf
sudo systemctl restart unbound