Executive brief
A vulnerability in the Unbound DNS resolver can allow an attacker to repeatedly clear the system's internal cache. Unbound is a widely used tool for translating human-readable web addresses into computer-readable IP addresses. By forcing the cache to clear, an attacker can degrade the performance of the DNS service and potentially disrupt internet connectivity for users relying on that server.
Technical details
A vulnerability exists in NLnet Labs Unbound up to version 1.25.1 when 'unwanted-reply-threshold' is enabled. An attacker controlling a delegation can return in-bailiwick glue records of 0.0.0.0 or ::0. On systems that route these addresses (such as Linux routing them to loopback), Unbound's own listener may respond from a different IP (e.g., 127.0.0.1). This IP mismatch causes Unbound to flag the response as an 'unwanted reply,' incrementing a counter that, once reached, triggers a full cache flush of message and RRset caches. Because the counter resets after the flush, the attacker can sustain this loop indefinitely without spoofing packets. The fix in version 1.25.2 adds 0.0.0.0/::0 to the 'do-not-query-address' list by default.
Affected products
- NLnet Labs Unbound up to and including 1.25.1
Timeline
- 2026-07-22: advisory: Initial advisory published by NLnet Labs
- 2026-07-22: patched: Version 1.25.2 released with fix