Description
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
Published: 2026-09-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Unbound versions up to 1.26.0 contain a vulnerability in the TCP/DoT reading procedure that allows an attacker to send a continuous stream of distinct DNS queries over a single connection. This can monopolize a worker process, causing it to block on processing those requests and preventing other clients from receiving timely responses. The weakness is categorized as CWE‑1050 and CWE‑770.

Affected Systems

NLnet Labs Unbound. Versions 1.26.0 and earlier are affected. The issue is resolved in version 1.26.1 and later releases.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. While the EPSS score is not reported, the absence of a KEV listing suggests no known widespread exploitation at this time. The attack requires the ability to maintain a persistent TCP or DoT connection to the Unbound server and continuously issue unique, uncached queries. If these conditions are met, the attacker can achieve denial of service by exhausting server resources.

Generated by OpenCVE AI on September 16, 2026 at 14:00 UTC.

Remediation

Vendor Solution

This issue is fixed starting with version 1.26.1

OpenCVE Recommended Actions

  • Upgrade Unbound to version 1.26.1 or later.
  • Restrict or throttle the number of simultaneous queries per connection or close connections that become blocked.
  • Monitor network traffic for unusually high request rates on a single TCP/DoT connection and apply rate‑limiting or blocking rules as needed.

Generated by OpenCVE AI on September 16, 2026 at 14:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1050
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 16 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Description In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
Title Possible degradation of service from continuous queries on the same TCP/DoT connection
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-09-16T14:33:08.344Z

Reserved: 2026-09-07T14:06:21.952Z

Link: CVE-2026-80225

cve-icon Vulnrichment

Updated: 2026-09-16T14:33:01.748Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-16T09:17:06.100

Modified: 2026-09-16T19:41:10.423

Link: CVE-2026-80225

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-16T08:30:04Z

Links: CVE-2026-80225 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T14:15:09Z

Weaknesses
  • CWE-1050

    Excessive Platform Resource Consumption within a Loop

  • CWE-770

    Allocation of Resources Without Limits or Throttling