NLnet Labs Unbound CVE-2026-85501

Exploitation requires that the target run NLnet Labs Unbound (<=1.26.0) as a DNSSEC-validating recursive resolver - DNSSEC validation must be enabled, which is standard for validating resolvers - and that the attacker can cause the resolver to recurse into and validate an attacker-controlled malicious zone (achievable by getting any client to look up names under the attacker's domain). The AdditionalTrap variant leverages Unbound's default behavior of DNSSEC-validating the ADDITIONAL section, so no non-default configuration is needed for that vector. Limiting factors: the attacker must control or serve the malicious zones, the resolver must actually perform DNSSEC validation (non-validating or forwarding-only resolvers that don't validate are less affected), and impact is service degradation/resource exhaustion rather than confidentiality or integrity loss.

This is a moderate-severity, availability-only issue whose signals are internally consistent and point to real-but-manageable risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) yields 7.5 driven entirely by A:H; there is no confidentiality or integrity impact. Supporting signals moderate the raw score: EPSS is low at 0.31% (24th percentile), SSVC reports Exploitation=none (no observed exploitation) with Technical Impact=partial and Automatable=yes, and there is no CISA KEV listing and no public exploit code identified. The SSVC 'partial' technical impact and the description's own wording ('degradation of service') sit in tension with the vendor's A:H rating - I lean toward A:L (a resolver slowdown/resource-waste rather than a full crash-based outage), which would place the base score nearer 5.3; defenders should treat A:H as a conservative upper bound. Automatable=yes is the notable amplifier: because the attack only requires a victim resolver to be induced to validate an attacker-served malicious zone (normal recursive behavior), it can be scripted at scale, so this is a legitimate patch-soon item for exposed validating resolvers rather than a drop-everything emergency. Net: prioritize based on exposure of the resolver, not on the 7.5 alone.

An attacker hosts one or more malicious DNSSEC-signed zones stuffed with numerous mismatched DNSKEY/RRSIG/DS records, deeply nested delegations, or excessive invalid NSEC records, then induces a victim's Unbound resolver to recurse into those zones (e.g., by triggering lookups for names under the attacker's domain). Each response forces Unbound to burn disproportionate CPU on DNSSEC validation - including the ADDITIONAL section, which Unbound validates by default - degrading the resolver's throughput for all clients. No public exploit code is identified at time of analysis, but the attack is unauthenticated, network-based, and low-complexity.