# CVE-2026-96405: NLnet Labs Unbound DNS decompression CPU exhaustion

Source: https://junglewise.ai/threats/cve-2026-96405-nlnet-labs-unbound-up-to-and-including-version-1-26-1-limits  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-96405 · Severity: medium · CVSS 5.3 · Published 2026-10-21

Unbound is a DNS resolver that processes domain name queries from networks and the internet. An attacker who controls a delegated authority and can send specially crafted DNS replies can cause Unbound to consume excessive CPU by exploiting how it decompresses domain names, degrading performance for all users relying on that resolver.

Technologies: [NLnet Labs Unbound](https://junglewise.ai/threats/technologies/unbound). Vendors: [NLnet Labs](https://junglewise.ai/threats/vendors/nlnet-labs).

## Quick answers

**Is CVE-2026-96405 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96405 being exploited in the wild.

**How severe is CVE-2026-96405?** Medium severity, with a CVSS score of 5.3, published 21 October 2026.

**Which products and versions are affected?** NLnet Labs Unbound up to and including 1.26.1.

**Is there a fix for CVE-2026-96405?** Yes: fixed in Unbound 1.26.2. Until then: Apply the patch manually to Unbound 1.26.1 using the provided patch file (CVE-2026-96405.diff or CVE-2026-96405_with.diff) and rebuild with 'make install'. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96405 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-96405?** Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Unbound 1.26.2

Apply the patch manually to Unbound 1.26.1 using the provided patch file (CVE-2026-96405.diff or CVE-2026-96405_with.diff) and rebuild with 'make install'.

## Technical details

Unbound limits compression-pointer traversal per individual domain-name operation but lacks an aggregate decompression-work budget across a message. An attacker with recursive-query access and control of a delegated authority can craft replies with chained compression pointers to force excessive CPU consumption during decompression of upstream replies and zone transfers. The fix introduces aggregate limits of 2048 per upstream reply and 128,000 per zone transfer packet.

## Affected products

- NLnet Labs Unbound up to and including 1.26.1

## Timeline

- 2026-10-21: disclosed

## References

- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-96405.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-96405.txt)

## Related threats

- [NLnet Labs Unbound use-after-free in DNS-over-QUIC stream cleanup](https://junglewise.ai/threats/cve-2026-97206-nlnet-labs-unbound-1-22-0-up-to-and-including-version-1-26-1)
- [NLnet Labs Unbound DNS validator bypass in DNSSEC validation](https://junglewise.ai/threats/cve-2026-50106-when-nlnet-labs-unbound-up-to-and-including-version-1-26-1-is)
- [NLnet Labs Unbound cache side-channel in upstream source port probe](https://junglewise.ai/threats/cve-2026-109125-in-nlnet-labs-unbound-up-to-and-including-version-1-26-1-an)
- [NLnet Labs Unbound DNS complexity attacks via ReTrap](https://junglewise.ai/threats/cve-2026-85501-nlnet-labs-unbound-dns-complexity-attacks-via-retrap)
- [NLnet Labs Unbound use-after-free in DNS-over-HTTPs](https://junglewise.ai/threats/cve-2026-82720-nlnet-labs-unbound-use-after-free-in-dns-over-https)