Skip to main content

NLnet Labs Unbound CVE-2026-41292

| EUVDEUVD-2026-31078 MEDIUM
Inefficient Algorithmic Complexity (CWE-407)
2026-05-20 sep@nlnetlabs.nl GHSA-2wvj-gvc7-gfhx
Denial Of Service Unbound Nlnetlabs
6.6
CVSS 4.0 · Vendor: nlnetlabs
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify internet-facing Unbound resolver
  2. Delivery
    Craft DNS queries with excessive EDNS options
  3. Exploit
    Send sustained coordinated query flood
  4. Execution
    Unbound threads blocked in option parsing loop
  5. Persist
    Thread pool exhausted
  6. Impact
    Legitimate DNS queries denied or severely degraded

Vulnerability Assessment

Weakness
CWE
CWE-407
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
Exploitation Conditions

No special conditions are required for network reachability: the CVSS vector confirms AV:N/AC:L/AT:N/PR:N/UI:N, meaning any host able to send UDP or TCP DNS queries to an exposed Unbound instance can attempt exploitation with no authentication, no prior access, and no user interaction needed. The attack is effective regardless of whether Unbound is operating as a recursive resolver, authoritative server, or caching resolver. The limiting factor for achieving full denial of service (rather than degradation) is the need for coordinated or sustained query volume sufficient to saturate Unbound's thread pool - a single low-rate source is unlikely to fully incapacitate a well-resourced resolver. Exploitation impact is strictly limited to availability; confidentiality and integrity of DNS data are unaffected (VC:N/VI:N in CVSS vector).
Impact

The CVSS 4.0 score of 6.6 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H accurately captures network-reachable, zero-prerequisite exploitation with no confidentiality or integrity impact but high availability impact on the vulnerable component. The E:U (Exploit Maturity: Unreported) modifier confirms no public exploit code exists at scoring time. No CISA KEV listing is present, meaning active exploitation is not confirmed. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified. Despite the unauthenticated network vector and low attack complexity, real-world risk is modulated by the need for sustained or coordinated query floods to achieve full denial of service - a single source is likely to cause only degradation. Operational criticality of DNS infrastructure elevates the practical risk: resolvers serving high-traffic recursive or authoritative roles are more susceptible than lightly loaded instances. The U:Red urgency label in the CVSS vector signals vendor-assessed need for prompt remediation. No signals conflict here - CVSS vector, description, and CWE are mutually consistent.
Exploit ScenarioDerived

An attacker - or a coordinating set of distributed hosts - sends a continuous stream of DNS queries to an internet-facing Unbound resolver, each query containing the maximum feasible number of EDNS options. Each such query consumes disproportionate thread time in Unbound's EDNS option parser and data structure allocator; with enough concurrent malformed queries, all available worker threads become occupied processing attacker traffic, and legitimate DNS resolution requests queue indefinitely or time out. No POC code has been publicly identified, but the attack requires only standard DNS query crafting tooling with custom EDNS option padding.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 20, 2026

Unbound DNS resolver versions up to and including 1.25.0 allow remote unauthenticated attackers to degrade or deny service by sending DNS queries carrying abnormally large numbers of EDNS options, causing resolver threads to become occupied with unbounded parsing and internal data structure allocation. Coordinated multi-source attacks amplify thread exhaustion into full denial of service for legitimate DNS clients. No public exploit identified at time of analysis; vendor-released patch is available in Unbound 1.25.1, which enforces a hard cap of 100 incoming EDNS options.

RemediationAI

The primary and definitive fix is to upgrade to Unbound 1.25.1 or later, which patches the vulnerability by enforcing a hard limit of 100 incoming EDNS options per query, as documented at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt. For deployments where immediate upgrading is not feasible, a compensating control is to deploy an EDNS-aware DNS firewall or proxy upstream of Unbound configured to drop or truncate queries containing more than a threshold number of EDNS options; note that this requires EDNS-inspecting appliances and risks false positives against legitimate high-option queries. Additionally, restricting the resolver's listener to trusted client IP ranges (via Unbound's access-control: directives) eliminates attack surface from untrusted networks, at the cost of excluding open-resolver use cases. Rate-limiting inbound DNS queries per source IP at the firewall layer reduces coordinated flood effectiveness but does not eliminate single-source degradation.

Affected VersionsENISA

Unbound 0 <1.25.1

Affected Packages

euvd unbound fix: 1.25.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Unbound is an open-source validating, recursive, and caching DNS resolver maintained by NLnet Labs. EDNS (Extension Mechanisms for DNS, RFC 6891) extends the base DNS protocol by allowing additional option fields to be carried in queries and responses. The vulnerability stems from Unbound's failure to bound the number of EDNS options it will process per incoming query: for each option present, the resolver allocates and populates internal data structures before enforcing any limit. This maps directly to CWE-407 (Inefficient Algorithmic Complexity), where attacker-controlled input size drives unbounded computational work - thread time scales linearly (or worse) with option count. The affected product is NLnet Labs Unbound, all releases up to and including 1.25.0. No CPE string was supplied in the input, but the product is identifiable as cpe:2.3:a:nlnetlabs:unbound with version constraint ≤ 1.25.0.

Know when Unbound gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (nlnetlabs) PRIMARY 6.6 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Red
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (nlnetlabs).

CVSS VectorVendor: nlnetlabs

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

1
Patch available
May 20, 2026 - 11:02 EUVD

DescriptionCVE.org

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).

Threat Intelligence Overview

EPSS Score
0.0%
Top 85% exploitable
Social Media
2
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

33
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +33
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Unbound

View all
CVE-2019-18934 HIGH POC
7.3 Nov 19

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
CVE-2026-81642 CRITICAL
9.1 Sep 16

A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC

CVE-2026-33278 CRITICAL
9.1 May 20

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
CVE-2026-42959 HIGH
8.7 May 20

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
CVE-2026-42944 HIGH
8.7 May 20

Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
CVE-2026-82717 HIGH
8.4 Sep 16

Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker wh
CVE-2019-16866 HIGH
7.5 Oct 03

Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIF
CVE-2026-32665 HIGH
7.5 Jul 22

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
CVE-2026-55973 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone

CVE-2026-40691 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
CVE-2026-81634 HIGH
7.5 Sep 16

Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-fr
CVE-2026-85501 HIGH
7.5 Sep 16

Denial-of-service through algorithmic complexity attacks in NLnet Labs Unbound up to and including 1.26.0 can degrade or

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-54892 HIGH POC
8.7
CVE-2026-90776 HIGH POC
8.7
CVE-2026-59094 HIGH POC
8.7
CVE-2026-13311 HIGH POC
8.7
CVE-2026-54284 HIGH POC
8.7
CVE-2022-45061 HIGH POC
7.5
CVE-2026-71321 HIGH POC
7.5
CVE-2026-56669 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Micro 5.5 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-41292 ADVISORY https://ubuntu.com/security/notices/USN-8282-1 ADVISORY https://vuldb.com/vuln/364849 REF https://access.redhat.com/errata/RHSA-2026:24013 REF https://access.redhat.com/errata/RHSA-2026:36320 REF https://access.redhat.com/errata/RHSA-2026:36777 REF https://access.redhat.com/errata/RHSA-2026:37282 REF https://access.redhat.com/errata/RHSA-2026:54769 REF https://access.redhat.com/security/cve/CVE-2026-41292 REF https://bugzilla.redhat.com/show_bug.cgi?id=2480125 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json REF https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy