CVE-2026-55973 'dns-error-reporting: yes' leads to stack buffer overflow
A stack buffer overflow in Unbound's DNS error reporting allows remote attackers to crash the daemon via a malicious upstream response.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55973?
CVE-2026-55973 is a high-severity memory corruption vulnerability in Nlnetlabs Unbound, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.
Weakness: CWE-20
Which versions are affected by CVE-2026-55973?
It affects 1 product.
Products include Nlnetlabs Unbound.
How do I fix CVE-2026-55973?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-55973 being exploited?
There is no known exploitation of CVE-2026-55973 in the wild and no public exploit code.
Other vulnerabilities in Nlnetlabs Unbound
- CVE-2026-81642 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
- CVE-2026-33278 Possible arbitrary code execution during DNSSEC validation
- CVE-2026-42944 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
- CVE-2026-42959 Crash during DNSSEC validation of malicious content
- CVE-2026-82717 CNAME synthesis could lead to heap corruption
Sources
Also known as ALPINE-CVE-2026-55973, AZL-92919, DEBIAN-CVE-2026-55973, ECHO-60a1-36c5-6226, GHSA-g479-fg97-pf5w, ROOT-OS-DEBIAN-11-CVE-2026-55973 and 2 more.