NLnet Labs Unbound CVE-2026-42923

Unbound is a validating, recursive DNS resolver developed by NLnet Labs that implements DNSSEC (DNS Security Extensions). NSEC3 (RFC 5155) is a denial-of-existence mechanism in DNSSEC that uses iterated SHA-1 hashing to produce hashed owner names, preventing zone enumeration. The iteration count embedded in NSEC3 records controls how many times the hash function is applied - higher values increase computational cost. Unbound 1.19.1 introduced a cap on NSEC3 hash iterations to mitigate exactly this class of CPU exhaustion. However, the separate code path that consults the negative cache for DS (Delegation Signer) records - used during DNSSEC chain-of-trust validation for delegated zones - was never updated to enforce this cap. CWE-407 (Inefficient Algorithmic Complexity) is the root cause: the number of hash operations is O(iterations) and is attacker-controlled via a zone they legitimately operate. A compounding factor is a global lock on the negative cache, held for the full duration of the hashing; under concurrent query load this becomes a serialization bottleneck across all resolver threads.