Executive brief
Unbound, a widely used tool for translating website names into IP addresses, is vulnerable to a performance-based attack. By sending specially crafted network traffic, an attacker can force the system to spend excessive time processing data, leading to significant slowdowns or a complete service outage. This could prevent users from accessing websites and internal services that rely on the affected Unbound server.
Technical details
A vulnerability exists in Unbound's name compression logic when handling very large RRsets. While a compression limit was introduced in version 1.21.1 to mitigate CPU exhaustion, it failed to account for records that do not share a suffix above the root. In such cases, a compression tree lookup failure causes the engine to follow a code path that bypasses the compression counter increment. An attacker can exploit this by querying Unbound for a malicious zone containing these crafted RRsets, leading to unbounded CPU usage and a denial of service. This issue is addressed in version 1.25.1 by ensuring the compression counter is incremented regardless of the lookup result.
Affected products
- NLnet Labs Unbound up to and including 1.25.0
Timeline
- 2026-05-20: advisory: Advisory published by NLnet Labs and NVD
- 2026-05-20: patched: Fixed in Unbound version 1.25.1