p PatchFirst

ALPINE-CVE-2026-44621

ALPINE-CVE-2026-44621

This page contains facts from public vulnerability sources. Check the original advisory before updating.

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is registed in the allow list and proceeds to perform the documented cache flush.

CVSS 5.9 · Medium · Fix available

Published
Updated

Stack: system

Affected products and versions

  • unbound Alpine:v3.22

    Affected ranges
    • ECOSYSTEM: < 1.25.2-r0

    Update to 1.25.2-r0

  • unbound Alpine:v3.23

    Affected ranges
    • ECOSYSTEM: < 1.25.2-r0

    Update to 1.25.2-r0

  • unbound Alpine:v3.24

    Affected ranges
    • ECOSYSTEM: < 1.25.2-r0

    Update to 1.25.2-r0

Original sources

Check your server →