Quick answers
- Is CVE-2026-85501 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85501 being exploited in the wild.
- How severe is CVE-2026-85501?
- Medium severity, with a CVSS score of 5.3, published 16 September 2026.
- Which products and versions are affected?
- NLnet Labs Unbound up to and including 1.26.0.
- Is there a fix for CVE-2026-85501?
- A patch was published on 2026-09-16: Unbound 1.26.1 released with fixes; patch also available for 1.26.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-85501 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-85501?
- Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability encompasses multiple DNSSEC algorithmic complexity attack vectors (TagTrap, DelegationTrap, NsecTrap, AdditionalTrap) that exploit resource-intensive validation logic in Unbound's DNSSEC processing. TagTrap abuses the triple(Zone, Algo, KeyTag) matching of DNSKEY and RRSIG records; DelegationTrap exploits iterative chain-of-trust validation for deeply nested domains; NsecTrap forces validation of excessive NSEC records; AdditionalTrap abuses optional validation of the DNS ADDITIONAL section. All attacks are network-reachable and require no authentication or user interaction—an attacker can send crafted DNS responses to trigger resource exhaustion. Unbound 1.26.1 patches all four attack vectors by introducing resource limits and throttling mechanisms. Versions prior to 1.26.1 are vulnerable.
Affected products
- NLnet Labs Unbound up to and including 1.26.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Unbound 1.26.1 released with fixes; patch also available for 1.26.0