Unbound vulnerabilities

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability in the DNSSEC validator enables denial of service and possible remote code execution via DNSKEY processing. A crafted DNSKEY can overflow the digest buffer.

In Unbound library versions 1.4.22 through 1.25.1, a vulnerability allows DNS cache poisoning attacks. The issue arises from deterministic assignment of UDP port ranges to worker threads when SO_REUSEPORT is enabled, enabling an attacker to predict the source port and reduce DNS transaction entropy.

NLnet Labs Unbound up to version 1.25.0 is vulnerable to cache poisoning via promiscuous records in the authority section. An attacker can inject non-NS records (e.g., MX) along with address records that Unbound caches, leading to cache poisoning. Version 1.25.1 includes a fix that disregards address records from the additional section if they are not explicitly relevant to NS records.

NLnet Labs Unbound from version 1.19.1 to 1.25.0 has a vulnerability in the DNSSEC validator due to a struct-assignment bug during deep copy, leading to a dangling pointer and potential code execution.

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message result in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.

In NLnet Labs Unbound up to and including version 1.26.1, when configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). When a response-like UDP datagram reaches the upstream source port currently used by a recursive query but its TXID does not match any pending query, Unbound counts it as an unwanted reply and, upon reaching the threshold, clears the worker's RRset and message caches, allowing an external observer to distinguish whether a candidate port matches the current upstream source port.

NLnet Labs Unbound up to and including 1.26.0 is vulnerable to algorithmic complexity attacks (known as 'ReTrap') that cause service degradation. Attacks include TagTrap (large number of mismatched DNSKEY, RRSIG, DS records), DelegationTrap (costly iterative validation for deeply nested domains), NsecTrap (excessive invalid NSEC records), and AdditionalTrap (default validation of ADDITIONAL section).

NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPS support with '--with-libnghttp2'. During failure code paths (e.g., RPZ drop, jostle), a dropped DoH stream brings down the whole DoH session and does not account properly for other streams, leading to use-after-free. An attacker can trigger it with a single DoH connection, but impact is limited as reads are not user controlled; however, a hardened allocator can catch the use-after-free and controllably terminate the process, causing DoS.

In NLnet Labs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.

NLnet Labs Unbound 1.22.0 up to and including 1.26.1 has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer holding the DNS response, and ngtcp2's retransmission buffer keeps a shallow pointer into it. On client RESET_STREAM, the output buffer is freed but ngtcp2 still holds matching retransmission entries, leading to use-after-free on next PTO. An unprivileged attacker can trigger this by querying over DoQ, withholding ACKs, sending RESET_STREAM, and waiting for PTO, causing abnormal server exit.

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, in zones with ZONEMD enabled (zonemd-check: yes) located below a trust anchor, there is an attack window where tampered zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution before the ZONEMD check completes. If a zonefile is written to disk while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again.

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.

In Unbound 1.20.0 through 1.25.1, with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0', the discard-timeout logic fails to properly decrement a counter, leading to new clients being dropped and service degradation. An attacker can exploit this by querying a slow authoritative zone.

In NLnet Labs Unbound up to version 1.25.1, when building the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, the validator computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it directly to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. An attacker running a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk through stale bytes in the 'env->scratch_buffer', past the end of its heap allocation if 'msg-buffer-size' has been lowered. This leads to a heap buffer overflow.

In Unbound 1.22.0 through 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions) and crash the Unbound process using a single DoQ connection and one DNS query. This is due to passing an erroneous error value to libngtcp2.

In Unbound 1.7.0 through 1.25.1, when there are more DNSCrypt certificates than keys, Unbound fills leftover slots with '0xdb' bytes. An unauthenticated client sending a UDP datagram ≥68 bytes with first 8 bytes '0xdb' to the DNSCrypt port can crash the server.

In Unbound 1.10.0 through 1.25.1, with 'serve-expired: yes' and a 'response-ip' or 'rpz-cname-override' rule, a remote client controlling a delegated domain can crash the daemon. This is due to an inconsistency in the CNAME alias handling logic in serve-expired-client-timeout.

In Unbound from version 1.6.0 up to 1.25.1, the 'view_local_data' and 'view_local_datas' commands in 'unbound-control' create a bare local zone tree for a view without default-protected zones (e.g., RFC 1918 reverse, AS112, .onion, .localhost). This causes queries for these names to be forwarded to public DNS instead of being answered locally, bypassing local policy.

In NLnet Labs Unbound from 1.18.0 up to 1.25.1, when listening on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node validates for every PROXYv2-declared source behind that node. An off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks.

In Unbound 1.25.0 through 1.25.1, a fix enabling 'respip' and 'dns64' modules to work together creates a shallow copy of the view name, which can lead to memory corruption when the original view name owner is evicted under load. Crash likelihood is low.

In NLnet Labs Unbound up to 1.25.1, with 'unwanted-reply-threshold' enabled, glue records 0.0.0.0/::0 can cause a loop leading to cache clearing. An attacker controlling a delegation can repeatedly trigger cache flushes without spoofed packets.

NLnet Labs Unbound versions 1.7.0 to 1.25.1 have a vulnerability where an auth/rpz zone with a configured primary hostname that resolves to BOGUS A/AAAA is still considered a possible XFR endpoint. An attacker who can spoof the A/AAAA record (no valid RRSIG required) becomes the XFR primary and can replace the entire zone or resolver's response policy.

In Unbound from 1.6.2 up to 1.25.1, when configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. An attacker can exploit this by spoofing BOGUS A/AAAA answers.

In Unbound 1.15.0 through 1.25.1, the TLS server name used for DoT queries is tied to a 'serviced_query' struct but also referenced by 'waiting_tcp'. When the struct is evicted during TLS handshake and an error occurs, a freed pointer is dereferenced, causing a daemon crash.

NLnet Labs Unbound versions 1.22.0 through 1.25.1 have a vulnerability where a single client query for a deeply nested name under a DNSSEC-signed parent can cause more upstream packets than the configured 'max-global-quota'. This bypasses a security configuration that limits amplification traffic.

In NLnet Labs Unbound from 1.6.0 to 1.25.1, a wildcard RRset replay can be temporarily considered DNSSEC-secure based on RRSIG validation and cached. Later NSEC validation marks it as bogus, but another thread may use it for a reply, replacing a specific record with a wildcard. The attack requires a DNSSEC-signed domain and a CNAME record pointing to a sibling record of a wildcard.

In Unbound 1.7.0 up to 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during aggressive NSEC processing (RFC 8198) leads to cache poisoning. This allows an attacker controlling one delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains.

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, an off-by-one error in the 'harden-below-nxdomain' logic allows stub or forward zones below a DNSSEC signed zone to be shadowed by a secure NXDOMAIN answer from the parent, bypassing the configuration.

In NLnet Labs Unbound up to 1.25.1, applications using libunbound with 'unwanted-reply-threshold' enabled may be abruptly terminated when the threshold is reached because 'libworker_alloc_cleanup' is not in the allowed call list. Unbound itself is not affected.

Unbound DNS server versions 1.16.2 through 1.25.1 are vulnerable to a 'ghost domain names' attack, allowing an adversary controlling a ghost zone to extend the ghost domain window by one configured TTL for A/AAAA glue records. With 'harden-referral-path: yes', no client query is needed.

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly, inflating the number of waiting replies for in-flight queries and causing degradation of resolution service for new clients.

In Unbound versions 1.9.0 through 1.25.1, when handling DNSCrypt queries over TCP, the reply encryption routine does not bound the reply length to the destination buffer size. A reply larger than 65504 bytes can cause a heap buffer overflow, leading to resolver crash (DoS). Requires DNSCrypt support enabled.

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Unbound exceed the configured 'quic-size' limit with low-cost input. Using only one connection and two streams, each sending a declared 65535-byte length prefix and then holding the streams open, a client can already trivially make Unbound roughly allocate double that amount. This is a remote availability issue / memory-accounting bypass in the downstream DoQ implementation that leads to denial of service for new DoQ clients. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.

NLnet Labs Unbound versions 1.22.0 through 1.25.1 in DNS-over-QUIC environments with high concurrency can crash due to an assertion in libngtcp2 about monotonic timestamps. Unbound used realtime instead of monotonic time, causing server termination under load.

NLnet Labs Unbound from version 1.14.0 up to 1.25.0 has a locking inconsistency vulnerability that under certain conditions (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) can lead to heap use-after-free and crash. An attacker can exploit if conditions are met. Unbound 1.25.1 contains a fix.

NLnet Labs Unbound up to version 1.25.0 has a vulnerability when handling replies with very large RRsets that require name compression. Malicious upstream responses with very large RRsets whose records do not share a suffix above the root can cause Unbound to spend considerable time applying name compression, leading to degraded performance and potential denial of service. The compression limit introduced in 1.21.1 did not account for records without a common suffix above the root, bypassing the compression counter. The fix in 1.25.1 increments the compression counter regardless of the compression tree lookup.

NLnet Labs Unbound up to version 1.25.0 inclusive contains a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. The issue stems from using the wrong counter to calculate write offsets for ADDITIONAL section rrsets. An attacker controlling a DNSSEC-signed domain can trigger a crash with a single query.

A vulnerability in Unbound (versions 1.14.0 through 1.25.0) causes a heap overflow when encoding multiple NSID, DNS Cookie, and EDNS Padding options in the reply packet. A flaw in the EDNS field size calculation leads to out-of-bounds write.

NLnet Labs Unbound up to version 1.25.0 has a vulnerability in the DNSSEC validator where the negative cache code path for DS records does not respect the NSEC3 hash calculation limit introduced in 1.19.1.

NLnet Labs Unbound versions up to 1.25.0 contain a vulnerability in the jostle logic that can degrade resolution performance. Duplicate queries can refresh the timestamp, preventing the jostle logic from replacing old queries with new ones. An attacker controlling a slow DNS server can exploit this to degrade Unbound's performance.

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch limiting acceptable incoming EDNS options to 100.

Unbound versions 1.16.2 through 1.25.0 are vulnerable to a 'ghost domain names' attack that can extend the ghost domain window by one TTL value. The attacker needs control over a ghost zone and the ability to query a vulnerable Unbound. A fix is available in version 1.25.1.

NLnet Labs Unbound from version 1.6.2 to 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support. A malformed DNSCrypt query can underflow the packet reading procedure, potentially leading to heap overflow.

A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers (DDR) request when triggered via the autoUpgrade (Lua) option for newServer or the auto_upgrade (YAML) setting. DDR is not enabled by default.

NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets, and 1.24.2 adds further scrubbing for YXDOMAIN and non-referral nodata replies.

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. The vendor does not consider this a vulnerability of Unbound itself, as the script is a community contribution and not part of the Unbound installation.

Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.