CVE-2026-42944 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
An attacker can cause a heap overflow and crash the Unbound DNS resolver by sending queries with multiple EDNS options when specific features are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42944?
CVE-2026-42944 is a high-severity memory corruption vulnerability in Nlnetlabs Unbound, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.
Which versions are affected by CVE-2026-42944?
It affects 1 product.
Products include Nlnetlabs Unbound.
How do I fix CVE-2026-42944?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-42944 being exploited?
There is no known exploitation of CVE-2026-42944 in the wild and no public exploit code.
Other vulnerabilities in Nlnetlabs Unbound
- CVE-2026-81642 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
- CVE-2026-33278 Possible arbitrary code execution during DNSSEC validation
- CVE-2026-42959 Crash during DNSSEC validation of malicious content
- CVE-2026-82717 CNAME synthesis could lead to heap corruption
- CVE-2026-81634 Possible heap buffer overflow during DNSSEC canonicalization
Sources
Also known as ALPINE-CVE-2026-42944, AZL-87042, DEBIAN-CVE-2026-42944, ECHO-7892-53ae-a3fb, GHSA-7mmq-q3m9-jrv7, ROOT-OS-DEBIAN-11-CVE-2026-42944 and 2 more.