Unbound DNS EUVD-2026-47675

Two concurrent conditions are required for exploitation. First, Unbound must have 'unwanted-reply-threshold' explicitly set to any integer greater than zero in unbound.conf - this is not a default setting and must be deliberately configured by the operator; deployments with the default (disabled/zero) configuration are entirely unaffected. Second, the Unbound instance must run on a system (the CVE description specifically identifies Linux) where the OS kernel routes datagrams destined for 0.0.0.0 over the loopback interface, causing Unbound's own listener at 127.0.0.1 to answer the queries; behavior on non-Linux platforms is unconfirmed. Additionally, the attacker must control or operate a DNS delegation (an authoritative zone) that the victim resolver's clients will resolve, limiting exploitation to actors with DNS infrastructure access. Limiting factors: the non-default configuration gate excludes the majority of Unbound deployments; no spoofed packets are required but a controlled delegation is; impact is restricted to cache flushing with no data exfiltration or code execution possible per CVSS C:N/I:N.

CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3) accurately reflects the network-reachable, no-auth attack surface, but the Low availability impact score may understate operational impact on high-traffic resolvers: repeated cache flushes force recursive re-resolution of every cached record, causing latency spikes and significantly increased upstream query load during sustained attack. The attack is, however, gated on a non-default configuration: unwanted-reply-threshold must be explicitly set to a value greater than zero in unbound.conf - deployments where the feature is disabled are entirely unaffected. The Linux-specific loopback routing behavior cited in the description further narrows the real-world attack surface. No EPSS score was present in the provided intelligence, no CISA KEV listing exists, and no public proof-of-concept code has been identified, collectively suggesting this is a newly vendor-disclosed theoretical attack with no observed in-the-wild exploitation. The tags in the source data include 'Information Disclosure,' which is inconsistent with the CVSS (C:N, I:N) and the CVE description - that tag appears erroneous and should not be used to elevate risk assessment. Real priority: moderate for operators who have explicitly enabled unwanted-reply-threshold on Linux-based Unbound resolvers; low or negligible for all others.

An attacker who operates or has compromised an authoritative nameserver for any delegated DNS zone crafts NS records whose in-bailiwick hostnames resolve to A/AAAA glue records containing 0.0.0.0 or ::0. When a victim Unbound resolver (running on Linux with unwanted-reply-threshold set to a non-zero value) resolves any name within that zone, it follows the delegation, queries 0.0.0.0, and receives a reply from its own listener at 127.0.0.1 via Linux loopback routing. The IP mismatch causes Unbound to increment the unwanted-reply counter; the attacker repeatedly drives queries to the zone until the counter reaches the threshold, triggering a full cache flush - at which point the counter resets and the cycle can begin again, causing indefinite cache degradation with no spoofed packets required and no special network position needed beyond operating a DNS delegation.