Quick answers
- Is CVE-2026-96405 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-96405 being exploited in the wild.
- How severe is CVE-2026-96405?
- Medium severity, with a CVSS score of 5.3, published 21 October 2026.
- Which products and versions are affected?
- NLnet Labs Unbound up to and including 1.26.1.
- Is there a fix for CVE-2026-96405?
- Yes: fixed in Unbound 1.26.2. Until then: Apply the patch manually to Unbound 1.26.1 using the provided patch file (CVE-2026-96405.diff or CVE-2026-96405_with.diff) and rebuild with 'make install'. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-96405 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-96405?
- Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Unbound 1.26.2
Apply the patch manually to Unbound 1.26.1 using the provided patch file (CVE-2026-96405.diff or CVE-2026-96405_with.diff) and rebuild with 'make install'.
Technical details
Unbound limits compression-pointer traversal per individual domain-name operation but lacks an aggregate decompression-work budget across a message. An attacker with recursive-query access and control of a delegated authority can craft replies with chained compression pointers to force excessive CPU consumption during decompression of upstream replies and zone transfers. The fix introduces aggregate limits of 2048 per upstream reply and 128,000 per zone transfer packet.
Affected products
- NLnet Labs Unbound up to and including 1.26.1
Timeline
- 2026-10-21: disclosed