Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2026-42959

Access of Uninitialized Pointer

Published: May 20, 2026 | Modified: Jun 30, 2026
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-42959
CWEhttps://cwe.mitre.org/data/definitions/824.html

NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.

Weakness

The product accesses or uses a pointer that has not been initialized.

Affected Software

NameVendorStart VersionEnd Version
UnboundNlnetlabs*1.25.1 (excluding)
Red Hat Enterprise Linux 10RedHatunbound-0:1.24.2-7.el10_2.1*
Red Hat Enterprise Linux 8RedHatunbound-0:1.16.2-5.11.el8_10*
Red Hat Enterprise Linux 9RedHatunbound-0:1.24.2-3.el9_8.1*
Red Hat Hardened ImagesRedHatunbound-main-1.25.1-0.1.hum1*
UnboundUbuntudevel*
UnboundUbuntuesm-infra-legacy/trusty*
UnboundUbuntuesm-infra-legacy/xenial*
UnboundUbuntuesm-infra/bionic*
UnboundUbuntuesm-infra/focal*
UnboundUbuntuesm-infra/xenial*
UnboundUbuntujammy*
UnboundUbuntunoble*
UnboundUbuntuquesting*
UnboundUbunturesolute*

Extended Description

If the pointer contains an uninitialized value, then the value might not point to a valid memory location. This could cause the product to read from or write to unexpected memory locations, leading to a denial of service. If the uninitialized pointer is used as a function call, then arbitrary functions could be invoked. If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks. Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use