Vulnerability · CVE-2026-42944
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/o…
Published May 20, 2026 · catalog updated Aug 26, 2026 · OpenBSD OpenBSD
Check if you run it
No confirmed exploitation is on record for CVE-2026-42944. EPSS is 0.78%. Act only if a listed version of OpenBSD OpenBSD is installed.
Gaps on this record
- No version range is stored. A customer cannot check an installed version against this record.
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- High8.7
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.78%
- Remediation
- Advisory link
- Affected products
- cpe nlnetlabs/unbound
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- cpe nlnetlabs/unboundversion unspecified
How to fix CVE-2026-42944
Recommended remediation
A patch or advisory reference is linked. Open the original publisher for availability by product version.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-42944. EPSS is 0.78%. Act only if a listed version of OpenBSD OpenBSD is installed.
Which versions are affected?
Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-131; CWE-197; CWE-787: Out-of-bounds Write. EPSS 0.78%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 20, 2026 · NIST NVD
Detected
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulner
Aug 26, 2026 · NIST NVD
Updated
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulner
Sources
- CVE.orgVulnerability recordCVE-2026-42944
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-42944
30-day exploitation probability 0.8%
first.org - FreeBSD SecurityVendor advisoryCVE-2026-42944
CVE-2026-42944 is named by FreeBSD Security.
freebsd.org - NIST NVDVulnerability recordCVE-2026-42944
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (defau
nvd.nist.gov - OpenBSD ErrataVendor advisoryCVE-2026-42944
CVE-2026-42944 is named on the public OpenBSD Errata page.
openbsd.org
References
Freshness
Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.