NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.
CVSS Details
- CVSS 4.0 Base Score: 4.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber)
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade unbound | Jun 18, 2026 | May 20, 2026 |
| Amazon Linux Ami 2 | — | Upgrade python2-unboundUpgrade unbound-develUpgrade unboundUpgrade unbound-anchorUpgrade python3-unboundUpgrade unbound-debuginfoUpgrade unbound-libsUpgrade unbound-utils | Jul 21, 2026 | Jul 21, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-unbound-debuginfoUpgrade unbound-anchor-debuginfoUpgrade unbound-libs-debuginfoUpgrade unbound-debuginfoUpgrade unbound-develUpgrade unboundUpgrade unbound-debugsourceUpgrade unbound-utilsUpgrade python3-unboundUpgrade unbound-utils-debuginfoUpgrade unbound-libsUpgrade unbound-anchor | May 28, 2026 | May 20, 2026 |
| Debian | — | Upgrade unbound | Jul 23, 2026 | Jul 23, 2026 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Aug 13, 2026 | Aug 12, 2026 |
| Freebsd | — | Upgrade unboundUpgrade FreeBSD | Jun 15, 2026 | Jun 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | May 20, 2026 |
| Ubuntu | — | Upgrade unboundUpgrade libunbound8 | May 25, 2026 | May 20, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 22, 2026 | May 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub