Executive brief
Unbound is a widely used DNS resolver that translates human-readable website names into IP addresses. A vulnerability has been identified where a specially crafted request can cause the server to generate more outgoing network traffic than intended, bypassing safety limits. This could allow the server to be used in amplification attacks, potentially impacting network performance or service availability.
Technical details
A vulnerability classified as CWE-406 (Network Amplification) exists in NLnet Labs Unbound versions 1.22.0 through 1.25.1. The issue stems from the validator component failing to consistently track the global quota counter across subqueries and lookup restarts when processing deeply nested names under DNSSEC-signed parents. An unauthenticated remote attacker can send a single query that triggers more upstream packets than the configured 'max-global-quota' allows. This bypasses security configurations designed to limit resource consumption and amplification traffic. The issue is resolved in Unbound version 1.25.2.
Affected products
- NLnet Labs Unbound 1.22.0 through 1.25.1
Timeline
- 2026-07-22: advisory: Initial disclosure by NLnet Labs and NVD publication
- 2026-07-22: patched: Version 1.25.2 released with fix