EUVD-2026-80289
GHSA-8wrv-pfvg-j383
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remote unauthenticated (AV:N/PR:N) but must sustain a tuned stream keeping writes ahead of drain, so AC:H; only partial availability of a single worker, hence A:L and C:N/I:N.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
3DescriptionCVE.org
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
AnalysisAI
Sustained high-rate streams of distinct uncached names over TCP or DNS-over-TLS can monopolize a single NLnet Labs Unbound worker's event loop, degrading resolver availability for other clients in Unbound versions up to and including 1.26.0. The issue is remotely reachable and unauthenticated (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), but the attacker must hold a connection and keep write throughput ahead of the server's drain/processing so the unbounded consecutive-read loop never yields; impact is confined to the affected worker, is degradation rather than a crash, and ends once the traffic stops, while connection caps, query-rate limits, and upstream rate-limiting reduce feasibility. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to Unbound's TCP or DNS-over-TLS (DoT) listener (default 53/TCP and 853/TLS) on a resolver at or below version 1.26.0, and the ability to open and hold a connection over which the attacker streams a continuous, high rate of distinct uncached query names. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modest-severity denial-of-service issue, and the vendor's CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is well-calibrated rather than inflated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No fixed version is specified in the available data, so the primary action is to consult the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt and apply the patched Unbound release it identifies as soon as it is available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC
Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker wh
Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone
Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-fr
A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today