CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.26.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Unbound deployments up to and including version 1.26.0 are affected when they accept queries over TCP or DNS-over-TLS (DoT). The issue concerns a connection handled by a worker's TCP/DoT read path.
What does an attacker need to do to cause impact?
An attacker must be able to maintain a TCP/DoT connection and continuously send distinct, uncached names quickly enough that writes remain ahead of processing. No privileges or user interaction are required according to the supplied severity vector.
What is the practical impact of a successful attack?
The malicious connection can monopolize one worker's entire event loop for as long as the stream is sustained. This results in degradation of service rather than disclosure or modification of data.