CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NLnet Labs Unboundto a version that resolves this vulnerability.Fixed in 1.26.1
Event History
Frequently Asked Questions
Which deployments are exposed to these attacks?
NLnet Labs Unbound versions up to and including 1.26.0 are affected. Exposure arises when the resolver processes malicious zones or malicious DNS responses designed to trigger expensive DNSSEC validation work.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network access, low attack complexity, no privileges, and no user interaction. An attacker needs to cause the resolver to handle crafted DNSSEC-related data, such as mismatched DNSKEY, RRSIG, and DS records, deeply nested delegations, excessive invalid NSEC records, or malicious ADDITIONAL-section data.
Is a default configuration affected?
Yes. The AdditionalTrap issue specifically affects Unbound's default behavior of attempting DNSSEC validation of the ADDITIONAL section. Malicious users can exploit this behavior to consume validation resources.
What is the practical impact?
The documented impact is degradation of service through algorithmic-complexity attacks that consume resolver resources. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.