CVE-2026-56416: NLnet Labs Unbound Buffer Overflow Flaw

CVE-2026-56416 Overview

CVE-2026-56416 is a heap buffer overflow vulnerability in NLnet Labs Unbound up to and including version 1.25.1. The flaw resides in the DNSSEC validator when building the canonical RDATA form for RRSIG-covered PX, RP, MINFO, and SOA record sets. Unbound computes the address of a second embedded domain name without verifying its presence in the RDATA. An attacker operating a DNSSEC-signed authoritative server can deliver a crafted record that causes query_dname_tolower() to read past the end of the per-worker scratch buffer. The issue is tracked under [CWE-354: Improper Validation of Integrity Check Value].

Critical Impact
Successful exploitation triggers a heap buffer overflow in the resolver worker, potentially causing crashes or memory corruption when msg-buffer-size is lowered from its default.

Affected Products

NLnet Labs Unbound versions up to and including 1.25.1
Deployments configured with a reduced msg-buffer-size value
Recursive resolvers performing DNSSEC validation on PX, RP, MINFO, or SOA RRsets

Discovery Timeline

2026-07-22 - CVE-2026-56416 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-56416

Vulnerability Analysis

The vulnerability lives in the DNSSEC validator path that constructs canonical RDATA for RRsets containing two embedded domain names. Unbound calculates the location of the second domain name using datstart + dname_valid(datstart, ...) and passes the result directly to query_dname_tolower(). The code never confirms that a second name actually exists in the RDATA. The wire-format parser accepts multi-dname resource records whose RDATA terminates after the first name, creating a mismatch between what the parser tolerates and what the validator assumes.

Root Cause

The root cause is a missing length check in the canonicalization routine. When the RDATA ends after the first domain name, the computed pointer references stale bytes in the per-worker env->scratch_buffer. query_dname_tolower() then walks label-by-label through uninitialized or leftover memory. If msg-buffer-size has been lowered from the default, this label traversal proceeds past the end of the heap allocation, corrupting adjacent heap chunks.

Attack Vector

Exploitation requires the attacker to control a DNSSEC-signed authoritative name server. The attacker publishes a malformed PX, RP, MINFO, or SOA record whose RDATA omits the second domain name. When a victim Unbound resolver queries and validates the record, the validator triggers the overflow. On release builds, the outcome depends on the contents of the buffer tail and the layout of the adjacent heap chunk, ranging from silent memory corruption to process termination.

No verified proof-of-concept code has been published. Refer to the NLnet Labs CVE-2026-56416 Advisory for authoritative technical details.

Detection Methods for CVE-2026-56416

Indicators of Compromise

Unexpected unbound worker process crashes or restarts correlated with DNSSEC validation activity
DNS responses containing PX, RP, MINFO, or SOA records with truncated RDATA that ends after the first domain name
Elevated validation failures or SERVFAIL responses tied to specific authoritative zones

Detection Strategies

Inspect authoritative DNS responses for multi-dname RRs (PX, RP, MINFO, SOA) whose RDATA length does not accommodate a second embedded name
Monitor Unbound logs for validator errors and abnormal worker termination events
Deploy resolver-side canaries that flag malformed DNSSEC-signed responses reaching the validator

Monitoring Recommendations

Track unbound process stability, memory usage, and worker restart counts through your observability stack
Alert on non-default msg-buffer-size configurations across managed resolver fleets
Correlate resolver crash events with upstream authoritative servers queried in the preceding interval

How to Mitigate CVE-2026-56416

Immediate Actions Required

Upgrade Unbound to a version later than 1.25.1 that contains the vendor fix
Restore msg-buffer-size to its default value if it has been reduced, which limits the practical reach of the overflow
Restrict which authoritative zones your resolvers will validate where policy allows

Patch Information

NLnet Labs has published fix guidance in the NLnet Labs CVE-2026-56416 Advisory. Administrators should apply the vendor-supplied release that adds the missing bounds check before invoking query_dname_tolower() on the second embedded domain name.

Workarounds

Revert msg-buffer-size to the default so label traversal remains inside the allocated scratch buffer
Disable DNSSEC validation only as a last resort and only for resolvers where security posture permits
Front Unbound with an upstream resolver or filter that drops malformed PX, RP, MINFO, and SOA responses

bash

# Configuration example: restore default msg-buffer-size in unbound.conf
server:
    # Remove or comment out any lowered value such as:
    # msg-buffer-size: 8192
    # Leave unset to use the default (65552 bytes)