CVE-2026-44608— Use after free and crash under special conditions in RPZ code
Quick assessment
Affected
NLnet Labs Unbound
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NLnet Labs Unbound是NLnet Labs开源的一个高性能DNS解析器。 NLnet Labs Unbound 1.14.0至1.25.0版本存在安全漏洞，该漏洞源于锁定不一致，在特定条件下可能导致堆释放后重用和崩溃。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NLnet Labs | Unbound | 1.14.0< 1.25.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-44608
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Use after free and crash under special conditions in RPZ code
Source: CVE Program / CVE List V5
Vulnerability Description
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
Source: CVE Program / CVE List V5
Vulnerability Type
资源加锁不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
NLnet Labs Unbound 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NLnet Labs Unbound是NLnet Labs开源的一个高性能DNS解析器。 NLnet Labs Unbound 1.14.0至1.25.0版本存在安全漏洞，该漏洞源于锁定不一致，在特定条件下可能导致堆释放后重用和崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NLnet Labs | Unbound | 1.14.0 ~ 1.25.1 | - |
|
II. Public POCs for CVE-2026-44608
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44608
请登录查看更多情报信息。
Other References for CVE-2026-44608 (1)
Same Patch Batch · NLnet Labs · 2026-05-20 · 11 CVEs total
| CVE-2026-33278 | 9.1 CRITICAL | Possible arbitrary code execution during DNSSEC validation |
| CVE-2026-42959 | 8.7 HIGH | Crash during DNSSEC validation of malicious content |
| CVE-2026-42944 | 8.7 HIGH | Heap overflow with multiple NSID, COOKIE, PADDING EDNS options |
| CVE-2026-42534 | 6.9 MEDIUM | Jostle logic bypass degrades resolution performance |
| CVE-2026-44390 | 6.9 MEDIUM | Unbounded name compression in certain cases causes degradation of service |
| CVE-2026-41292 | 6.6 MEDIUM | Long list of incoming EDNS options degrades performance |
| CVE-2026-42923 | Degradation of service with unbounded NSEC3 hash calculations | |
| CVE-2026-42960 | Possible cache poisoning via promiscuous records for the authority section | |
| CVE-2026-32792 | Packet of death with DNSCrypt | |
| CVE-2026-40622 | Another 'ghost domain names' attack variant |
IV. Related Vulnerabilities
Same product: Unbound
-
CVE-2026-85501
Retrap: Novel Vulnerabilities to launch Algorithmic Complexi -
CVE-2026-82720
Use-after-free in DoH stream cleanup code path -
CVE-2026-82717
CNAME synthesis could lead to heap corruption -
CVE-2026-81642
Heap buffer overflow and possible Remote Code Execution when -
CVE-2026-81634
Possible heap buffer overflow during DNSSEC canonicalization
Same vendor: NLnet Labs
-
CVE-2026-85501
Retrap: Novel Vulnerabilities to launch Algorithmic Complexi -
CVE-2026-82720
Use-after-free in DoH stream cleanup code path -
CVE-2026-82717
CNAME synthesis could lead to heap corruption -
CVE-2026-81642
Heap buffer overflow and possible Remote Code Execution when -
CVE-2026-81634
Possible heap buffer overflow during DNSSEC canonicalization
Same weakness: CWE-413
-
CVE-2026-92615
Flightctl: flightctl: package-global go-git https transport -
CVE-2026-32748
Squid has Denial of Service in ICP Response handling -
CVE-2025-0003
AMD Xilinx Run Time 安全漏洞 -
CVE-2025-3450
Automation Runtime SDM requests may impact system -
CVE-2023-32253
Kernel: deadlock in ksmbd_find_crypto_ctx()
V. Comments for CVE-2026-44608
No comments yet