Executive brief
NLnet Labs Unbound, a widely used DNS resolver that translates domain names into IP addresses, contains a flaw that can lead to a service outage. Under specific non-default configurations, the system fails to properly track active network requests, eventually reaching a limit that prevents new users from accessing the service. An attacker can exploit this by forcing the system to handle slow requests, effectively blocking legitimate traffic and degrading network reliability.
Technical details
A resource management vulnerability (CWE-772) exists in NLnet Labs Unbound versions 1.20.0 through 1.25.1 when configured with 'serve-expired: yes' and a 'serve-expired-client-timeout' greater than 'discard-timeout'. In this specific configuration, the discard-timeout branch fails to decrement the counter for the number of reply addresses associated with a query when dropping an aged client reply. An attacker can exploit this by querying the resolver for a slow, attacker-controlled authoritative zone, causing the counter to reach its maximum limit. Once the limit is reached, Unbound silently drops new clients for duplicate in-flight queries, resulting in a denial-of-service. The issue is resolved in version 1.25.2.
Affected products
- NLnet Labs Unbound 1.20.0 up to and including 1.25.1
Timeline
- 2026-07-22: advisory: Initial advisory published by NLnet Labs and NVD
- 2026-07-22: patched: Unbound version 1.25.2 released with fix