Description
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.
Published: 2026-09-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via algorithmic complexity attacks
Action: Apply Patch
AI Analysis

Impact

The vulnerability, termed 'ReTrap', exploits algorithmic complexity weaknesses in DNSSEC processing. Attackers can craft malicious zones that trigger excessive validation work for DNSKEY, RRSIG, DS, and NSEC records, leading to resource exhaustion on the resolver. This degrades service availability but does not leak sensitive data. The weakness corresponds to CWE‑770, which involves excessive resource consumption.

Affected Systems

NLnet Labs Unbound versions up to and including 1.26.0 are affected. The vulnerability is specific to that product and does not extend to earlier or later releases beyond 1.26.0.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, suggesting no known widespread exploitation yet, and the issue is not listed in the CISA KEV catalog. However, the attack requires only DNS responses from malicious zones, making it remotely exploitable by anyone who can influence DNS traffic. The internal policy of Unbound to validate the additional section by default expands the attack surface, meaning that a domain administrator could easily cause a denial of service without modifying client applications.

Generated by OpenCVE AI on September 16, 2026 at 13:58 UTC.

Remediation

Vendor Solution

This issue is fixed starting with version 1.26.1

OpenCVE Recommended Actions

  • Upgrade Unbound to version 1.26.1 or later, which removes the vulnerable algorithmic complexity checks.
  • If upgrading immediately is not feasible, disable DNSSEC validation for the most trusted zones or temporarily reduce the number of validation checks using Unbound configuration options.
  • Implement network monitoring to detect unusual DNS traffic patterns that may indicate a complexity attack, and apply rate limiting or firewall rules to mitigate the impact.

Generated by OpenCVE AI on September 16, 2026 at 13:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 16 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Description Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.
Title Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-09-16T14:12:18.996Z

Reserved: 2026-09-07T14:06:21.977Z

Link: CVE-2026-85501

cve-icon Vulnrichment

Updated: 2026-09-16T14:12:14.616Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-16T09:17:06.783

Modified: 2026-09-16T19:41:10.423

Link: CVE-2026-85501

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-16T08:32:25Z

Links: CVE-2026-85501 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T14:00:11Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling