CVE-2026-56416— NLnet Labs Unbound 加密问题漏洞

Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

完整性检查值验证不恰当

NLnet Labs Unbound 加密问题漏洞

NLnet Labs Unbound是荷兰NLnet Labs组织的域名系统解析服务器。 NLnet Labs Unbound 1.25.1及之前版本存在加密问题漏洞，该漏洞源于构建RRSIG覆盖的PX/RP/MINFO/SOA RRset规范RDATA形式时，未检查第二个域名是否实际存在于RDATA中，导致‘query_dname_tolower()’函数逐标签遍历工作线程‘env->scratch_buffer’中的过期字节，当‘msg-buffer-size’从默认值降低时，将超出堆分配末尾，造成堆

N/A

N/A