Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1678

NIXPKGS-2026-1678
published on
Permalink CVE-2026-42944
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Provider Urgency (U): Red (Red)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 2 days, 12 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 17 hours ago
  • @LeSuisse ignored
    15 packages
    • luaPackages.luaunbound
    • lua51Packages.luaunbound
    • lua52Packages.luaunbound
    • lua53Packages.luaunbound
    • lua54Packages.luaunbound
    • lua55Packages.luaunbound
    • luajitPackages.luaunbound
    • prometheus-unbound-exporter
    • python312Packages.pyunbound
    • python313Packages.pyunbound
    • python314Packages.pyunbound
    • haskellPackages.unbound-generics
    • haskellPackages.unbounded-delays
    • haskellPackages.unbound-kind-generics
    • haskellPackages.unbound-generics-unify
    2 days, 12 hours ago
  • @LeSuisse accepted 2 days, 12 hours ago
  • @LeSuisse ignored maintainer @Scrumplex 2 days, 12 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 2 days, 12 hours ago
Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.

Affected products

Unbound
  • <1.25.1

Matching in nixpkgs

Ignored packages (15)

Package maintainers

Ignored maintainers (1)