NLnet Labs Unbound EUVD-2026-31081

The attacker must be the legitimate operator of a DNSSEC-signed DNS zone - they must have the ability to sign and publish NSEC3 records with elevated iteration counts for child delegations. This is a significant real-world barrier. Exploitation is triggered when a vulnerable Unbound instance performs recursive resolution and consults the negative cache for DS records in that zone. No authentication to Unbound itself is required (PR:N per CVSS vector), and no special Unbound configuration beyond default DNSSEC validation is needed. What limits exploitation: the attacker cannot be an arbitrary internet host - zone control is mandatory; impact is limited to availability (no data confidentiality or integrity impact); single-query impact is described as 'degradation' rather than outright crash; achieving full denial of service requires coordinated, sustained query volume. Deployments with DNSSEC validation disabled are not affected by this specific code path.

The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:L) reflects that the attack is network-reachable with no authentication or user interaction required from Unbound's perspective, but the impact is limited to low availability degradation. The critical nuance is the attack precondition: the adversary must control a DNSSEC-signed zone, which is a non-trivial real-world barrier - this is not a vulnerability exploitable by any arbitrary internet host. EPSS data was not provided; given the required precondition and absence from CISA KEV, real-world exploitation probability is expected to be low for most deployments. The global lock side effect is the most consequential amplifier: even modest iteration counts, multiplied across coordinated queries from multiple clients, can create thread starvation disproportionate to what the raw CVSS availability metric suggests. Recursive resolvers serving high query volumes (ISP resolvers, public DNS) face higher practical risk than lightly-loaded private deployments. No conflicting signals were identified in the available data.

An attacker who operates a DNSSEC-signed zone signs NSEC3 records for one or more child delegations using iteration counts that are high but within the threshold Unbound accepts as legitimate. When a client or the attacker directly queries a vulnerable Unbound resolver for DS records in those delegations, Unbound enters the unguarded code path, performs the full hash computation while holding the global negative cache lock, and stalls other threads for the duration. Coordinating this across multiple clients or automating repeated queries amplifies the effect into sustained service degradation or outage for all users of that resolver.