Locking Inconsistency Vulnerability in NLnet Labs Unbound

CVE-2026-44608

What is CVE-2026-44608?

The vulnerability in NLnet Labs Unbound versions 1.14.0 through 1.25.0 arises from a locking inconsistency triggered under specific conditions, such as during multi-threaded operations and RPZ XFR reloads. When the RPZ zone contains 'rpz-nsip' or 'rpz-nsdname' triggers, this issue can lead to a heap use-after-free scenario, potentially causing application crashes. An attacker could exploit this flaw if the necessary conditions are met, particularly if an ongoing XFR coincides with another thread reading the affected RPZ zone. In such cases, insufficient lock holding can result in freed objects being accessed by reading threads. The issue is resolved in version 1.25.1, which includes a fix for the locking mechanism.

References