CVE-2026-56416

{
  "id": "CVE-2026-56416",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-22T14:17:22.090",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk."
    },
    {
      "lang": "es",
      "value": "En NLnet Labs Unbound hasta la versión 1.25.1 inclusive, cuando el validador construye la forma canónica de RDATA para un conjunto de RR PX/RP/MINFO/SOA cubierto por RRSIG, calcula la dirección del segundo nombre de dominio incrustado como ’datstart + dname_valid(datstart, ...)’ y lo pasa directamente a ’query_dname_tolower()’ sin verificar que un segundo nombre esté realmente presente en el RDATA. El analizador de formato de cable acepta RRs multi-dname cuyo RDATA termina después del primer nombre, por lo que un atacante que ejecuta un servidor autoritativo firmado con DNSSEC puede entregar un registro con un segundo nombre de dominio ausente (p. ej., registro SOA) y hacer que ’query_dname_tolower()’ recorra etiqueta por etiqueta bytes obsoletos en el ’env  ->  scratch_buffer’ por trabajador, más allá del final de esa asignación de pila si ’msg-buffer-size’ se ha reducido del valor predeterminado. Esto conduce a un desbordamiento de búfer de pila y en una compilación de lanzamiento el resultado depende en gran medida del contenido de la cola del búfer y del fragmento de pila adyacente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NLnet Labs",
          "product": "Unbound",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.25.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T13:59:48.705600Z",
          "id": "CVE-2026-56416",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-354"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.25.2",
              "matchCriteriaId": "9C01A425-F6D7-49A7-A72D-BF2159564DB6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-56416.txt",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}