CVE-2026-56416

A vulnerability in Unbound allows remote attackers using malicious DNSSEC-signed servers to send malformed records that trigger a heap buffer overflow. This can cause a denial of service or potential limited information disclosure.

This Moderate impact flaw in Unbound allows a remote attacker to trigger a heap buffer overflow by providing specially crafted DNSSEC records from a malicious authoritative server. This can lead to a denial of service for the Unbound service or potentially limited information disclosure. Exploitation requires the Unbound DNSSEC validator to process malformed records, which may be exacerbated if msg-buffer-size is configured below its default value.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, consider disabling DNSSEC validation in Unbound if it is not strictly required for your environment. This can be achieved by ensuring module-config: "iterator" is used in unbound.conf and that no trust-anchor or auto-trust-anchor-file directives are present. Disabling DNSSEC validation will reduce the security assurances provided by DNSSEC. Alternatively, configure Unbound to only perform DNSSEC validation for trusted zones. A restart of the Unbound service is required for changes to take effect.