NLnet Labs Unbound CVE-2026-42534

Two concrete conditions must both be satisfied: (1) the attacker must be able to send DNS queries to the target Unbound resolver - either because it is an open resolver or because the attacker is on a permitted client network; and (2) the attacker must control an authoritative nameserver for at least one domain that Unbound will recursively resolve, configured to respond slowly or not at all. Additionally, the attack is only effective when Unbound's num-queries-per-thread limit is reached or nearly reached; at low load, jostle logic is not invoked and the vulnerability has no effect. The CVSS vector (AV:N/PR:N/UI:N) confirms no authentication to Unbound is required and no user interaction is needed, but the AT:N attribute (No Attack Requirements in CVSS 4.0 terminology) does not fully capture the real-world prerequisite of controlling a malicious authoritative nameserver. Cache hits and local-data responses are entirely unaffected, limiting exploitation to the recursive resolution path only.

The CVSS 4.0 base score of 6.9 (Medium) reflects a network-reachable, low-complexity, no-privilege, no-user-interaction vector (AV:N/AC:L/AT:N/PR:N/UI:N), but the availability impact is rated Low (VA:L) and all confidentiality and integrity metrics are None - consistent with the description's characterization as a performance degradation rather than a full outage or data exposure. The CVSS 4.0 U:Amber designation indicates the vendor considers residual uncertainty around real-world impact. EPSS data was not provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit has been identified. Critically, exploitation requires a two-party condition: the attacker must both reach the Unbound resolver with queries AND control an authoritative nameserver that responds slowly or not at all - a more complex attack posture than simple remote exploitation. Coordinated, sustained attacks that saturate the query queue could escalate impact toward denial of resolution service, but isolated attempts are unlikely to produce significant effect. The NVD tag 'Information Disclosure' appears inconsistent with the described impact (availability degradation); this may be a tagging error and should not be relied upon for risk classification.

An attacker registers a domain delegated to an authoritative nameserver under their control and configures that server to respond to Unbound's recursive queries with deliberate delays or not at all. The attacker then floods the target Unbound resolver with queries for subdomains of that domain, causing resolution slots to fill. When Unbound's num-queries-per-thread limit is reached, the attacker continues sending duplicate queries for the same names, resetting their aging timestamps and preventing the jostle logic from evicting them. Legitimate queries from real users cannot obtain resolution slots and time out, producing effective denial of recursive resolution service. No public exploit code has been identified at time of analysis.