NLnet Labs Unbound versions up to 1.26.1 allow an attacker with recursive‑query privileges to supply DNS responses that contain an excessive number of chained compression pointers. When Unbound processes these responses, it follows each pointer while performing name decompression, consuming substantial CPU cycles. The resulting resource exhaustion does not affect data integrity or confidentiality but can severely degrade overall service availability, effectively causing a denial‑of‑service condition for all queries handled by the server. The weakness falls under the CWE‑770.

NLnet Labs Unbound is affected in all publicly released builds up through version 1.26.1. The vulnerability applies to servers configured to perform recursive queries. Any environment that uses Unbound in a recursive capacity, especially those that trust zones controlled by the attacker, is affected.

The vulnerability has been assigned a CVSS score of 5.3, indicating moderate severity. The EPSS score is reported as less than 1 %, suggesting exploitation is currently unlikely, and the issue is not listed in CISA’s KEV database. However, an attacker who can control responses from a delegated authority—such as a compromised or maliciously controlled DNS zone—could trigger the high CPU cost by repeatedly querying the server with crafted packets. Because the attack exploits normal recursive query processing, it can be launched from outside the network once recursion is enabled, making it a potential outbound threat.