CVE-2026-96405: Aggregate DNS name chained pointer decompression work leads to degradation of service.
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NLnet Labs Unboundto a version that resolves this vulnerability.Fixed in 1.26.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Unbound deployments up to and including version 1.26.1 are exposed when an attacker has recursive-query access and controls an ordinarily delegated authority that can return crafted DNS replies.
What does an attacker need to exploit it?
The attacker must be able to send recursive queries to the Unbound resolver and operate or control a delegated authoritative DNS service. They use specially crafted replies containing many chained compression pointers to consume CPU.
What is the practical impact?
Exploitation can degrade Unbound's general performance through excessive CPU work during DNS name decompression. The provided data indicates an availability impact only, with no confidentiality or integrity impact.