Bug 2506137 (CVE-2026-56416)

Summary: CVE-2026-56416 unbound: Unbound: Heap buffer overflow via malformed DNSSEC record
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, anujha, aos-team-art-private, asdas, asoldano, bbaranow, bmaxwell, bstansbe, dlofthou, dpaolell, eglynn, istudens, ivassile, iweiss, jdelft, jjoyce, jpretori, jschluet, jupierce, lgarciaa, lhh, mbiarnes, mburns, mgarciac, mosmerov, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, ppalepu, ppostler, prdhamdh, rhel-process-autobot, rstancel, sghai, sidsharm, suppawar, thjenkin, vdosoudi, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A vulnerability in Unbound allows remote attackers using malicious DNSSEC-signed servers to send malformed records that trigger a heap buffer overflow. This can cause a denial of service or potential limited information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2506414, 2506415, 2506416, 2506417, 2506418, 2506419, 2506420, 2506421    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-22 14:02:03 UTC 
In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.