NLnet Labs Unbound CVE-2026-96405

Exploitation requires two concrete prerequisites stated in the advisory: (1) recursive-query access to the target Unbound resolver (i.e. the attacker is a permitted client of the resolver), and (2) control of an authoritative server for a zone that is ordinarily delegated and that Unbound will query, used to serve specially crafted replies containing many chained compression pointers. Affected versions are Unbound up to and including 1.26.1. Limiting factors: the need to control a delegated authority the victim resolver actually queries meaningfully narrows the attacker population beyond the AV:N/PR:N vector; impact is limited to CPU-driven performance degradation (A:L, Scope:Unchanged) rather than a crash or remote code execution.

This is a medium-severity availability issue (vendor CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity impact and only partial availability impact (A:L) - performance degradation, not a full crash or outage. The CVSS vector reads as network, low-complexity, unauthenticated, but the description adds a precondition the vector does not capture: the attacker must both have recursive-query access to the resolver AND control an ordinarily-delegated authoritative server that Unbound will query - note this discrepancy, the raw PR:N/AC:L understates the real attack prerequisites. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from the data; absence of these signals is not evidence of safety but does lower immediate urgency. Net assessment: a real but modest-priority hardening issue (resource-exhaustion DoS against a widely deployed resolver) rather than a high-urgency, actively-exploited threat - patch in normal maintenance cycles.

An attacker who can send recursive queries to an Unbound resolver and who operates an authoritative nameserver for a zone the resolver will query returns DNS replies packed with many chained compression pointers. Because Unbound limits pointer traversal per name but enforces no aggregate decompression-work budget across a message, the resolver burns excessive CPU following the chains, degrading performance for all clients. No public exploit code was identified at time of analysis.