The CVE number for this vulnerability is CVE-2026-56416.


== Description
When the validator builds the canonical RDATA form for an RRSIG-covered
PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain
name as 'datstart + dname_valid(datstart, ...)' and passes it straight to
'query_dname_tolower()' without checking that a second name is actually present
in the RDATA.
The wire-format parser accepts multi-dname RRs whose RDATA ends after the
first name, so an attacker who runs a DNSSEC-signed authoritative server can
deliver a record with an absent second domain name (e.g. SOA record) and cause
'query_dname_tolower()' to walk label-by-label through stale bytes in the
per-worker 'env->scratch_buffer', past the end of that heap allocation if
'msg-buffer-size' has been lowered from the default.

This leads to heap buffer overflow and on a release build the outcome relies
heavily on the contents of the buffer tail and the adjacent heap chunk.

Unbound 1.25.2 includes a fix that rejects truncated multi-dname RDATA at
ingest.


== Affected products
Unbound up to and including version 1.25.1.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-56416.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-56416.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.