EUVD-2026-80294
GHSA-qwgf-hj58-8c2w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable resolver, no auth or interaction, availability-only degradation (A:L not A:H) with no confidentiality/integrity impact; matches vendor score.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
3DescriptionCVE.org
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.
AnalysisAI
Algorithmic complexity attacks against DNSSEC validation in NLnet Labs Unbound 1.26.0 and earlier let remote unauthenticated attackers degrade resolver performance by steering queries to malicious zones that amplify validation work - TagTrap (floods of mismatched DNSKEY/RRSIG/DS records), DelegationTrap (deeply nested chain-of-trust validation), NsecTrap (excessive invalid NSEC records), and AdditionalTrap (Unbound's default DNSSEC validation of the ADDITIONAL section). Exploitation requires a DNSSEC-validating Unbound resolver and attacker control of the zone being resolved, and impact is limited to resource exhaustion (CVSS 5.3, availability Low) rather than compromise or a guaranteed crash. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) a validating DNSSEC-enabled Unbound resolver version ≤1.26.0 - DNSSEC validation is the affected code path; and (2) an attacker-controlled malicious DNSSEC zone that the resolver can be induced to query. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-severity issue whose signals are internally consistent - unusual for the recent Unbound batch. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | A fixed release version is not specified in the provided data; consult the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt for the patched version and upgrade Unbound as directed, since the vulnerable logic lives in the validation path and only a patched build fully removes the ReTrap attack surface (patch status: vendor guidance should be confirmed before relying on any specific fix version). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC
Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker wh
Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone
Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-fr
A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today