Executive brief
Unbound, a widely used DNS resolver, contains a flaw in how it handles certain security records (DNSSEC). An attacker can exploit this by forcing the system to perform excessive mathematical calculations, which slows down the service. In a coordinated attack, this can lead to a complete denial of service, preventing users from accessing websites and other internet resources.
Technical details
Unbound versions up to 1.25.0 contain an algorithmic complexity vulnerability (CWE-407) in the DNSSEC validator. The code path for consulting the negative cache for DS records fails to enforce the NSEC3 hash calculation limits introduced in version 1.19.1. An attacker controlling a signed zone can provide NSEC3 records with high iteration counts; when queried, Unbound performs excessive hashing while holding a global lock on the negative cache. This blocks other threads and can lead to service degradation or a full denial of service. The issue is resolved in version 1.25.1.
Affected products
- NLnet Labs Unbound up to and including 1.25.0
Timeline
- 2026-05-20: disclosed
- 2026-05-20: advisory
- 2026-05-20: patched: Fixed in version 1.25.1