CVE-2026-44621

A flaw was found in libunbound, a library used by applications for DNS resolution. A remote attacker could exploit this vulnerability by sending specially crafted network traffic. This could cause applications using libunbound to terminate unexpectedly, leading to a denial of service (DoS). This occurs when the 'unwanted-reply-threshold' is configured, and the application attempts to call a cleanup function that is not properly allowed, resulting in a fatal exit.

A Moderate denial of service flaw exists in libunbound where applications configured with unwanted-reply-threshold can be terminated by specially crafted network traffic. This occurs when the libworker_alloc_cleanup function is called, which is not on the allow list for embedded applications. The unbound daemon itself is not affected as it uses a different, allowed function.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that any applications using libunbound do not set the unwanted-reply-threshold to a non-zero value. Disabling or setting this threshold to zero prevents the vulnerable code path from being triggered.