NLnet Labs Unbound EUVD-2026-31088

The vulnerability is triggered when Unbound processes a DNS reply containing a very large RRset where the individual records share no common suffix above the root (i.e., every record's domain name is entirely unique at every label). This requires the attacker to control or compromise an authoritative DNS zone with such specially crafted content, or to be in a position to inject malicious upstream responses (e.g., via DNS cache poisoning or on-path interception). Exploitation is limited by the following factors: the attacker must control a DNS zone or be able to inject authoritative responses; the attack is not self-contained - victim queries must be directed toward the malicious zone; and the availability impact is rated Low (VA:L in CVSS 4.0), meaning degraded rather than complete loss of service under most conditions. No authentication is required (PR:N) and no user interaction is needed (UI:N) once the malicious zone is in place. Default Unbound configurations that perform open recursive resolution are more exposed than those restricted to controlled upstream sources.

The CVSS 4.0 base score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:L reflects a remotely triggerable, low-complexity attack requiring no authentication or user interaction, with limited (not total) availability impact on the vulnerable system. The Amber urgency modifier (U:Amber) suggests the vendor considers this a real but not critical-urgency issue. EPSS data was not provided, so exploitation probability cannot be quantified from this dataset. The vulnerability is not listed in the CISA KEV catalog and no public exploit or POC has been identified, indicating no confirmed active exploitation. The real-world risk is moderate but operationally meaningful for organizations running Unbound as an Internet-facing recursive resolver: a well-orchestrated attack - requiring an adversary to operate or compromise an authoritative DNS zone and direct victims to query through the target Unbound instance - could degrade resolver performance and cause denial of service. The attack prerequisites (zone control or MITM position for malicious upstream responses) raise the effective complexity beyond what the AC:L vector might suggest for casual attackers, but are well within reach of motivated threat actors targeting specific infrastructure.

An attacker registers or compromises an authoritative DNS zone and populates it with a very large RRset in which every record has a fully unique label with no shared suffixes above the root. The attacker then causes the target Unbound resolver to query this zone - either by directing victim clients to resolve names in that zone or by poisoning upstream referrals - triggering the unbounded name compression loop. In a well-orchestrated campaign involving repeated such queries, Unbound's CPU becomes saturated processing compression for each reply, degrading or halting DNS resolution for all downstream clients. No public POC code has been identified at time of analysis.