CVE-2026-80225 in Unbound
Summary
by MITRE • 09/16/2026
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in NLnetLabs Unbound versions up to 1.26.0 represents a significant denial-of-service risk rooted in the handling of TCP and DNS over TLS connections. The core technical flaw lies within the reading procedure for these protocols, where the implementation fails to enforce a limit on consecutive read operations. In a standard secure design, input processing should be bounded by either byte limits or request counts to prevent any single connection from consuming excessive resources. However, in this specific scenario, an attacker who can sustain a stream of distinct, uncached DNS names over a TCP or DoT connection is able to keep the worker thread occupied indefinitely. The condition for exploitation relies on the attacker maintaining their write rate ahead of the server's ability to drain and process these requests effectively. This creates a situation where the event loop dedicated to handling that specific worker becomes monopolized, preventing it from servicing other legitimate queries or managing additional connections.
From an operational perspective, this flaw allows a malicious actor to degrade service availability for all users relying on the affected Unbound instance. Because DNS resolvers are often critical infrastructure components serving high volumes of requests, the occupation of a single worker's event loop can lead to increased latency and timeouts for other clients sharing that worker thread pool. In environments where resource allocation is not strictly isolated per connection or request type, this vulnerability can cascade into broader service degradation. The attacker does not need to send malformed packets or exploit buffer overflows; instead, they leverage the protocol's legitimate mechanics of streaming queries against a resolver that lacks sufficient backpressure mechanisms for uncached lookups. This makes detection and mitigation more challenging as the traffic appears normal but is designed specifically to exhaust computational resources through sustained volume rather than structural exploitation.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, specifically in the context of a denial-of-service attack where an application fails to limit the amount of resources consumed by a single user or connection. Furthermore, it maps to MITRE ATT&CK technique T1498.002, Network Denial of Service: Reflection Amplification, although here the amplification is achieved through sustained request volume rather than packet size manipulation. The attack vector involves network access and requires the ability to establish a TCP or DoT connection, making it relevant for both internal and external threat actors with network reachability to the DNS resolver.
Mitigation strategies should focus on implementing strict limits on concurrent connections per source IP address and enforcing rate limiting on query rates for uncached domains. Administrators of Unbound instances affected by this issue are advised to upgrade to a version where these reading procedures have been hardened with appropriate bounds checking. Additionally, configuring the server to drop or throttle requests that exceed defined thresholds can help mitigate the impact until an update is applied. Network-level controls such as ingress filtering and rate limiting at the firewall level can also provide a layer of defense by preventing any single source from sustaining the high-volume stream required to trigger this vulnerability effectively.