The CVE number for this vulnerability is CVE-2026-44621.


== Summary
Applications using libunbound and configured with 'unwanted-reply-threshold',
could eventually be abruptly terminated if the threshold is reached and
libunbound needs to call 'libworker_alloc_cleanup' since the function is absent
from the function call allow list.

Unbound 1.25.2 includes a fix to include the 'libworker_alloc_cleanup' function
in the allow list of function calls.


== Affected products
Unbound up to and including version 1.25.1.


== Description
When an application using libunbound sets 'unwanted-reply-threshold' to
any non-zero value and the iterator queries an authoritative that replies
with enough wrong-transaction-ID UDP datagrams to cross the threshold, the
'libworker_alloc_cleanup' will eventually be called.
Since the function is absent from the function call allow list, this leads to a
fatal exit of libunbound and eventual termination of the embedding application.

Unbound itself is not affected since its relevant function
'worker_alloc_cleanup' is registed in the allow list and proceeds to perform
the documented cache flush.

Unbound 1.25.2 includes a fix to include the 'libworker_alloc_cleanup' function
in the allow list of function calls.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-44621_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-44621_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-44621.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.