Executive brief
NLnet Labs Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A vulnerability has been identified where an attacker can send specially crafted network requests that overwhelm the system's processing power. This can lead to a significant slowdown or a complete shutdown of DNS services, preventing users from accessing websites and other internet resources.
Technical details
Unbound is vulnerable to an algorithmic complexity attack (CWE-407) and resource exhaustion (CWE-770) during the parsing of Extension Mechanisms for DNS (EDNS) options. An unauthenticated remote attacker can send DNS queries containing an excessive number of EDNS options, which forces Unbound threads to spend significant CPU time creating and managing internal data structures. In a coordinated attack, this 'hostage' thread behavior can lead to a complete denial of service. The vulnerability is addressed in Unbound version 1.25.1 by implementing a hard limit of 100 acceptable incoming EDNS options.
Affected products
- NLnet Labs Unbound up to and including 1.25.0
Timeline
- 2026-05-20: advisory: NLnet Labs published the security advisory and CVE-2026-41292 was released.
- 2026-05-20: patched: Unbound version 1.25.1 released with the fix.