Executive brief
NLnet Labs Unbound, a widely used DNS resolver that translates domain names into IP addresses, contains a flaw in how it manages slow-running queries. An attacker can exploit this by sending repeated requests for a slow or malicious domain, tricking the system into keeping those "stuck" queries active instead of clearing them for new traffic. This can lead to significant performance degradation or a complete denial of service, preventing users from reaching websites or online services.
Technical details
A vulnerability exists in Unbound's 'jostle' logic, which is designed to replace old, slow-resolving queries with new ones when the 'num-queries-per-thread' limit is reached. The root cause is that duplicate incoming queries update the timestamp of an existing resolution effort to the current time. This prevents the jostle mechanism from identifying these queries as aged, allowing them to occupy query slots indefinitely. An attacker controlling a slow authoritative nameserver can send retransmitted queries to keep Unbound's query buffers full, leading to a denial of resolution service. The issue is fixed in version 1.25.1 by implementing a non-updatable start time for each query.
Affected products
- NLnet Labs Unbound up to and including 1.25.0
Timeline
- 2026-05-20: advisory: NLnet Labs published the advisory and CVE-2026-42534 was released.
- 2026-05-20: patched: Unbound version 1.25.1 released with a fix.