5.9

CVE-2026-44608: nlnet labs unbound Improper Resource Locking

CVSS: 5.9v3.1MediumAnalyzed
AliasesALPINE-CVE-2026-44608UBUNTU-CVE-2026-44608DEBIAN-CVE-2026-44608
Published 20-05-2026Last modified 20-05-2026
Open JSON

Vulnerability summary

CVE-2026-44608 is a medium (CVSS 5.9) Improper Resource Locking vulnerability in nlnet labs unbound. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.4% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
5.9/10
010
Medium · v3.1 (NVD)
EPSS score
0.28%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 6
OPENSUSE-SU-2026:10903-1OPENSUSE-SU-2026:21083-1RHSA-2026:19752SUSE-SU-2026:22160-1SUSE-SU-2026:22213-1SUSE-SU-2026:2369-1

Timeline

  1. 20-05-2026
    PublishedVulnerability first disclosed.
  2. 20-05-2026
    Last modifiedVulnerability information updated.

Description

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

CVSS metrics

7 scores · 5 sources · 2 versions

EPSS trend

Probability

0.28%

Chance of exploitation in the next 30 days

Percentile

19%

Versus all other CVEs

30-day change

+0.03 pp

From 0.26% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.28%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Alpine1 product
  • unbound≥ 1.14.0, < 1.25.2-r0 | ≥ 1.14.0, < 1.25.1-r0
Debian1 product
  • unboundAll versions (No fix recorded) | < 1.22.0-2+deb13u3 | < 1.25.1-1
Nlnet labs1 product
Nlnetlabs1 product
Ubuntu1 product
  • unboundAll versions (No fix recorded) | < 1.19.2-1ubuntu3.8 | < 1.22.0-2ubuntu2.3 | < 1.24.2-1ubuntu2.1

5 vendors · 5 products

References

8 links