Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2026-56416

In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-56416
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 10:33 UTC · Revision 1

Source evidence

CVE-2026-56416

core-osv · Original source

Published 22 Jul 2026, 14:17 UTC

In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.

osv:CVE-2026-56416
Complete source record
{
  "id": "4a0912f4c26dd15a84be18c741426203b87e5e1233ef140f67d78571e3d196dc",
  "url": "https://osv.dev/vulnerability/CVE-2026-56416",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2026-56416",
    "summary": "In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.",
    "evidence": "osv:CVE-2026-56416",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-56416",
      "aliases": [
        "CVE-2026-56416"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nlnetlabs/unbound",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "c33ad1b1a21e48bfe4f140e90252a9be1b0c5745"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.25.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "release-1.25.1",
            "release-1.25.0",
            "release-1.25.0rc1",
            "release-1.24.0",
            "release-1.24.0rc1",
            "release-1.23.0rc1",
            "release-1.22.0",
            "release-1.22.0rc1",
            "release-1.21.0",
            "release-1.21.0rc1",
            "release-1.20.0rc1",
            "release-1.20.0",
            "release-1.19.3rc1",
            "release-1.19.0rc1",
            "release-1.19.0",
            "release-1.18.0",
            "release-1.18.0rc1",
            "release-1.16.2",
            "release-1.16.1rc1",
            "release-1.16.1",
            "release-1.16.0rc1",
            "release-1.16.0",
            "release-1.15.0rc1",
            "release-1.15.0",
            "release-1.14.0rc1",
            "release-1.14.0",
            "release-1.13.2",
            "release-1.13.2rc1",
            "release-1.13.1rc2",
            "release-1.13.1",
            "release-1.13.1rc1",
            "release-1.13.0rc4",
            "release-1.13.0rc3",
            "release-1.13.0rc2",
            "release-1.13.0rc1",
            "release-1.12.0rc1",
            "release-1.12.0",
            "release-1.11.0rc1",
            "release-1.11.0",
            "1.11.0rc1",
            "release-1.10.0rc2",
            "release-1.10.0rc1",
            "release-1.9.6",
            "release-1.9.6rc1",
            "release-1.9.3rc2",
            "release-1.9.3",
            "release-1.9.3rc1",
            "release-1.9.2",
            "release-1.9.2rc3",
            "release-1.9.2rc1",
            "release-1.9.2rc2",
            "final-svn-state",
            "release-1.9.1rc1",
            "release-1.9.0rc1",
            "release-1.8.2rc1",
            "release-1.8.1rc1",
            "release-1.8.0rc1",
            "release-1.7.3rc1",
            "release-1.7.2rc1",
            "release-1.7.1rc1",
            "release-1.7.0rc3",
            "release-1.7.0rc2",
            "release-1.7.0rc1",
            "release-1.6.7",
            "release-1.6.7rc1",
            "release-1.6.6rc2",
            "release-1.6.6rc1",
            "release-1.6.4rc2",
            "release-1.6.4rc1",
            "release-1.6.2rc1",
            "release-1.6.1rc3",
            "release-1.6.1rc2",
            "release-1.6.1rc1",
            "release-1.6.0rc1",
            "release-1.5.10rc1",
            "release-1.5.10",
            "release-1.5.9rc1",
            "release-1.5.8rc1",
            "release-1.5.8",
            "release-1.5.7",
            "release-1.5.6",
            "release-1.5.6rc1",
            "release-1.5.5",
            "release-1.5.5rc1",
            "release-1.5.4rc1",
            "release-1.5.4",
            "release-1.5.3rc1",
            "release-1.5.2",
            "release-1.5.2rc1",
            "release-1.5.1",
            "release-1.5.1rc2",
            "release-1.5.1rc1",
            "release-1.5.0rc1",
            "release-1.4.22",
            "release-1.4.22rc1",
            "release-1.4.20",
            "release-1.4.19",
            "release-1.4.19rc1",
            "release-1.4.18rc2",
            "release-1.4.18rc1",
            "release-1.4.17",
            "release-1.4.17rc1",
            "release-1.4.14",
            "release-1.4.14rc1",
            "release-1.4.13",
            "release-1.4.13rc2",
            "release-1.4.13rc1",
            "release-1.4.12rc1",
            "release-1.4.11rc3",
            "release-1.4.11",
            "release-1.4.11rc2",
            "release-1.4.11rc1",
            "release-1.4.9",
            "release-1.4.9rc1",
            "release-1.4.8rc1",
            "release-1.4.7",
            "release-1.4.7rc1",
            "release-1.4.6",
            "release-1.4.6rc1",
            "release-1.4.5",
            "release-1.4.5rc1",
            "release-1.4.4",
            "release-1.4.4rc1",
            "release-1.4.3",
            "release-1.4.2",
            "release-1.4.1",
            "release-1.4.0",
            "release-1.4.0rc1",
            "release-1.3.3",
            "release-1.3.3rc1",
            "release-1.3.2",
            "release-1.3.1",
            "release-1.1.1",
            "release-1.0.1",
            "release-0.11",
            "release-0.10",
            "release-0.8",
            "release-0.7",
            "release-0.6",
            "release-0.5",
            "release-0.4",
            "release-0.3",
            "release-0.1",
            "release-0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56416.json"
          }
        }
      ],
      "modified": "2026-10-26T02:30:22.291936331Z",
      "provider": "osv",
      "references": [
        "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-56416.txt"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2026-56416",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 446635,
  "published_at": "2026-07-22T14:17:22.09+00:00"
}