The vulnerability arises when Unbound processes DNS queries that contain an unusually large number of EDNS options. Each query forces Unbound to parse and construct internal data structures for every option, which can consume excessive memory and CPU resources. When an attacker sends a high‑volume stream of such queries, the server’s threads become occupied while parsing, leading to a degradation of service or a full denial of service for legitimate clients.

This issue affects NLnet Labs Unbound, specifically all releases through version 1.25.0 and earlier. Users running these versions are susceptible if they receive DNS traffic from untrusted networks. The patch that limits the number of accepted EDNS options is implemented in Unbound 1.25.1.

The CVSS base score of 6.6 indicates moderate severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the fact that the vulnerability can be triggered over the network suggests a realistic threat. Since the vulnerability remains absent from the CISA KEV catalog, it has not been documented as a widely exploited weakness yet. The attack path is a straightforward network‑based attack where an adversary sends crafted DNS queries with more than the allowed EDNS options, causing Unbound threads to hang during parsing.