CVE-2026-85501 in Unbound
Summary
by MITRE • 09/16/2026
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The ReTrap family of vulnerabilities represents a sophisticated class of algorithmic complexity attacks targeting Domain Name System Security Extensions (DNSSEC) implementations, specifically affecting NLnet Labs Unbound versions up to and including 1.26.0. These vulnerabilities exploit the computational intensity inherent in DNSSEC validation processes, allowing attackers to degrade service availability by forcing resolvers into excessive processing loops or resource exhaustion states. The core issue lies not in a traditional buffer overflow or injection flaw, but rather in the inefficient handling of cryptographic verification steps when faced with maliciously crafted zone data designed to maximize CPU cycles and memory usage without necessarily causing immediate crashes. This category of attack is classified under CWE-400, which covers Uncontrolled Resource Consumption, as well as CWE-770, Allocation of Resources Without Limits or Throttling, highlighting the failure to properly bound computational effort during validation routines.
TagTrap exploits a specific weakness in how resolvers match cryptographic keys by examining the triple consisting of Zone, Algorithm, and Key Tag. When an attacker serves malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS records, the resolver is compelled to perform extensive lookups and comparisons against its cache or local data stores. This mechanism fails to efficiently discard invalid combinations early in the process, leading to a significant increase in processing time proportional to the number of malformed entries injected by the attacker. The operational impact manifests as increased latency for legitimate queries and potential timeouts, effectively creating a denial-of-service condition through computational exhaustion rather than network bandwidth saturation.
DelegationTrap targets the iterative nature of building the chain of trust from the root zone downward toward deeply nested domains. In this scenario, an adversary constructs zones that require the resolver to perform repeated validation steps for DNSKEY and DS records at each level of delegation. For domains with deep nesting structures or those configured in a way that triggers excessive recursive lookups, this results in substantial computational overhead. The vulnerability arises because the resolver does not adequately limit the depth or complexity of trust chain verification, allowing attackers to force the system into prolonged validation cycles that consume significant CPU resources and delay response times for all users relying on that resolver instance.
NsecTrap leverages the requirement for resolvers to validate NSEC (Next Secure) records, which are used in DNSSEC to prove the non-existence of a domain name or record type. By serving responses with an excessive number of invalid NSEC records, attackers compel the resolver to perform validation checks on each individual entry. Since validating cryptographic signatures and checking bitmaps for existence is computationally expensive, flooding the resolver with these records creates a bottleneck in the resolution pipeline. This leads to resource contention where legitimate traffic suffers from increased latency or dropped connections due to the resolver being overwhelmed by the sheer volume of required verification operations triggered by the malicious NSEC data.
AdditionalTrap addresses a specific configuration behavior in Unbound where DNSSEC validation is applied to the ADDITIONAL section of responses by default. The additional section often contains records that are not strictly necessary for resolving the primary query but may include resource records with their own signatures and keys. Malicious users can exploit this by populating the additional section with numerous signed records containing complex cryptographic data, forcing the resolver to expend validation resources on these ancillary records. This unnecessary processing wastes CPU cycles and memory, contributing further to the degradation of service performance for legitimate clients attempting to resolve domains through the compromised resolver infrastructure.
Mitigation strategies primarily involve updating Unbound to versions that patch these specific algorithmic complexity flaws or applying configuration changes to limit the scope of DNSSEC validation where appropriate. Administrators should consider disabling DNSSEC validation in the additional section if it is not strictly required for their security posture, thereby neutralizing AdditionalTrap. Furthermore, implementing rate limiting and query filtering mechanisms can help mitigate the impact by restricting the volume of responses a single client or zone can trigger during validation cycles. Monitoring resolver performance metrics for spikes in CPU usage associated with DNSSEC processing can also aid in early detection of such attacks. Aligning these mitigations with industry standards like MITRE ATT&CK technique T1498, Network Denial of Service, ensures that defensive postures are comprehensive and address the underlying resource exhaustion vectors exposed by ReTrap vulnerabilities.