The vulnerability in Unbound arises from a flaw in its jostle logic, a mechanism that manages query scheduling when the server’s concurrent query limit is reached. Duplicate DNS queries from an attacker can reset the timestamp of a slow‑running query, causing the jostle algorithm to underestimate its age. This mis‑age skews the selection of candidate queries for replacement and results in the continued execution of slow queries while newer queries are starved. The net effect is a measurable degradation of DNS resolution performance. While cached or local data responses remain accurate, the overall throughput of the resolver can drop significantly.

Affected systems are NLnet Labs Unbound versions up to and including 1.25.0. The vendor released a fix in 1.25.1 that assigns a non‑updatable start time to each incoming query, restoring correct aging behavior. Systems still running older releases are vulnerable to the performance‑degrading bypass.

The CVSS score of 6.9 indicates a moderate severity, and the exploitability score is not published. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to send DNS queries to the vulnerable Unbound instance and control a DNS server that can reply slowly or maliciously to those queries. Under a coordinated attack, repeated slow responses could raise the resolver to a denial‑of‑resolution state. The lack of a public EPSS score makes the immediate risk difficult to quantify, but the presence of a patch and the moderate CVSS suggest that the vulnerability should be prioritized for remediation.