Executive brief
NLnetLabs Unbound is a DNS resolver used by organizations and ISPs to translate domain names into IP addresses. An attacker with network access to an Unbound server can send a sustained stream of DNS queries over TCP or encrypted DoT connections, causing the resolver to become unresponsive to legitimate requests. This can disrupt DNS resolution service for all users depending on that resolver.
Technical details
A denial-of-service vulnerability exists in Unbound versions up to 1.26.0 in the TCP/DoT (DNS-over-TLS) connection handling code where there is no limit on consecutive reads from a single connection. An attacker can stream distinct uncached DNS names over a TCP/DoT connection faster than the server can drain them, monopolizing a worker thread's event loop and preventing it from servicing other connections. The attack requires network access to the Unbound server's TCP/DoT port. Unbound 1.26.1 addresses this by implementing read limits on TCP/DoT connections similar to existing UDP handling.
Affected products
- NLnetLabs Unbound up to and including 1.26.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Unbound 1.26.1 released with fix