Unbound DNS servers up to version 1.25.0 perform name compression on outgoing replies. When an upstream response contains very large RRsets that do not share any suffix above the root, the compression algorithm can enter an unbounded loop because the compression counter is never incremented for those records. As a result the server spends a disproportionate amount of time applying compression, which can exhaust CPU resources and degrade performance, eventually leading to denial of service. This weakness is an unbounded operation (CWE‑407).

NLnet Labs Unbound, versions 1.25.0 and earlier. The fix was introduced in 1.25.1, so any instance running 1.25.1 or newer is no longer affected.

With a CVSS score of 6.9 the vulnerability is considered moderate to high severity. EPSS is not available, and the vulnerability has not been reported in the CISA KEV catalog, so current exploit evidence is limited. Nevertheless, the exploit path requires an attacker to send a DNS query containing a malicious zone with very large RRsets to the target Unbound server. The response handling is performed internally before any reply is returned, so the attack can be launched from the public internet or through a compromised upstream provider. The lack of a published exploit and the absence of a high EPSS score suggest that the risk of exploitation is moderate, but the potential for a denial‑of‑service impact makes it important to remediate promptly.