The vulnerability exists in the DNSSEC validation path of Unbound where the negative cache lookup for DS records ignores the NSEC3 hash calculation limits introduced in version 1.19.1. When an adversary controls a zone, they can create NSEC3 records with high iteration counts; queries to the vulnerable resolver will force these hash calculations without restraint, causing CPU or lock contention. This results in service degradation and, if repeated, can lead to a denial of service. The flaw is an example of uncontrolled resource consumption (CWE‑407).

The affected product is NLnet Labs Unbound. All releases up to and including 1.25.0 are vulnerable; the fix is included starting with 1.25.1. Users running Unbound 1.25.0 or older are susceptible.

The CVSS base score is 6.9, indicating a moderate severity. No EPSS score is currently available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker who controls a DNSSEC‑signed zone can issue malicious NSEC3 queries to a public or private Unbound server over the network. The exploit path only requires that the resolver follows the advertised NSEC3 chain and is reachable; no privileged access to the resolver is needed. Successful exploitation results in high NSEC3 hash workload and prolonged locking of the negative cache, blocking legitimate queries. Coordinated attacks can amplify the effect to full denial of service.