The CVE number for this vulnerability is CVE-2026-55973.


== Description
When 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code
18) from the last upstream response is read and uses the option's length as the
length of the agent domain.
When a domain name check is performed on the agent domain, the returned lenght
is not used and if the agent domain is followed by garbage, those bytes are
moved onto the tail of the synthetic '_er.' report query name.

That query name is later used in the iterator via a subquery to send out
the DNS Error Report and when Unbound tries to walk that query name during
'find_closest_of_type()', it strips labels using the query name length rather
than stopping at the embedded root, walks one byte past it, and feeds the first
garbage byte to 'dname_query_hash()' as a label length writing over the stack
variable 'labuf'.

One ordinary upstream response from a delegated zone the attacker controls is
sufficient to terminate the daemon.

Unbound 1.25.2 includes a fix to use the proper length of the agent domain name
instead of the EDNS option lenght one.


== Affected products
Unbound 1.23.0 up to and including version 1.25.1.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-55973.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-55973.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.