NLnet Labs Unbound EUVD-2026-80289

Requires network reachability to the Unbound resolver's TCP or DNS-over-TLS (DoT) listener, which the attacker must be able to open a connection to and hold open. Exploitation depends on the attacker sustaining a stream of distinct, uncached query names fast enough that connection writes stay ahead of the server's drain - cached-name floods do not trigger it. No authentication, special privileges, or user interaction are needed (PR:N/UI:N). Limiting factors: impact is confined to the single worker handling the malicious connection (multi-worker deployments retain partial service), the resolver must be exposed to the attacker over TCP/DoT rather than UDP-only or firewalled, and versions 1.26.1 and later remove the unbounded read.

This is a genuine but modest-priority availability issue, not a widespread-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a remote, unauthenticated, low-complexity attack with no user interaction - attractive on paper - but every corroborating signal points to limited real-world urgency: EPSS is only 0.31% (24th percentile), there is no CISA KEV listing, and no public exploit code was identified. SSVC reinforces a measured stance: Exploitation 'none', Automatable 'yes' (a sustained stream is trivially scriptable), and Technical Impact 'partial'. The 'partial' technical impact and the description's own wording ('degradation of service', 'monopolizes a single worker's event loop') conflict with the vendor's A:H (complete availability loss) rating - a multi-worker Unbound deployment would see one worker starved rather than the whole resolver collapse, which argues for A:L (~5.3) rather than A:H (7.5). Verify worker-count impact with the vendor advisory. Bottom line: real, easily automatable degradation-of-service against an important piece of DNS infrastructure, but low observed exploitation probability and only partial impact - patch on a normal cycle, not as a fire drill.

An unauthenticated attacker opens a single TCP or DNS-over-TLS connection to a reachable Unbound resolver and streams a sustained flood of distinct, uncached query names, keeping its writes ahead of the server's drain rate. Because there is no cap on consecutive reads, one worker's event loop is fully consumed servicing that connection, degrading or stalling query handling for other clients on that worker. No public POC or exploit code exists at time of analysis, but the technique is simple to script (SSVC Automatable: yes).