CVE Explorer

CVE-2026-44608

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ fi

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:63e1658325f1ceeaf8ff714fa23b49d3ece96a15439838cd2aacf5b0fe63a205

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Unbound","vendor":"NLnet Labs","versions":[{"lessThan":"1.25.1","status":"affected","version":"1.14.0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:27b43d8e90460e49584d20028ecbd50f9192fd267675624ed22e1b1c488aa29c · sha256:088271e4e99fda13… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":4.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber","version":"4.0"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:27b43d8e90460e49584d20028ecbd50f9192fd267675624ed22e1b1c488aa29c · sha256:088271e4e99fda13… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-413","description":"CWE-413: Improper Resource Locking","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:27b43d8e90460e49584d20028ecbd50f9192fd267675624ed22e1b1c488aa29c · sha256:088271e4e99fda13… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"tags":["vendor-advisory"],"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:27b43d8e90460e49584d20028ecbd50f9192fd267675624ed22e1b1c488aa29c · sha256:088271e4e99fda13… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer