CVE-2026-96405: 
Unbound vulnerability analysis and mitigation

CVE-2026-96405 is a Denial of Service vulnerability in NLnet Labs Unbound DNS resolver caused by unbounded DNS compression pointer traversal. Unbound versions up to and including 1.26.1 enforce per-operation limits on compression-pointer traversal but lack an aggregate inbound decompression-work budget, allowing many chained compression pointers in a single DNS message to consume excessive CPU resources. The vulnerability was published on October 21, 2026, with a patch available in version 1.26.2. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, NLnet Labs Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). Unbound's DNS message parsing applies per-operation limits when following compression pointers in domain names, but does not maintain a cumulative budget across all decompression operations within a single inbound message. An attacker who controls an ordinarily delegated DNS authority and has recursive-query access to the target Unbound instance can craft DNS reply messages containing many chained compression pointers, forcing Unbound to expend disproportionate CPU cycles traversing them. No public proof-of-concept code has been identified (GitHub Advisory, NLnet Labs Advisory).

Successful exploitation degrades Unbound's general DNS resolution performance, potentially causing service slowdowns or temporary unavailability for clients relying on the affected resolver. The impact is limited to availability — there is no confidentiality or integrity impact, and the vulnerability does not enable code execution or data exfiltration. The scope is confined to the Unbound process itself, with no evidence of lateral movement potential (GitHub Advisory, NLnet Labs Advisory).

No public proof-of-concept exploit or in-the-wild exploitation has been observed as of the disclosure date. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to control a delegated DNS authority and have recursive-query access to the target Unbound instance, which limits the attack surface compared to fully unauthenticated vulnerabilities (GitHub Advisory, NLnet Labs Advisory).

1. Identify target: Locate an Unbound resolver (version ≤ 1.26.1) that accepts recursive queries and delegates resolution to attacker-controlled DNS authority zones.
2. Establish delegated authority: Obtain or control a DNS zone that is ordinarily delegated by the target resolver (e.g., via a registered domain with NS records pointing to attacker-controlled nameservers).
3. Craft malicious DNS reply: Construct DNS response messages containing a large number of chained compression pointers in domain name fields, designed to maximize CPU traversal work per message without exceeding individual per-operation limits.
4. Trigger resolution: Cause the target Unbound resolver to issue queries to the attacker-controlled nameserver (e.g., by sending recursive queries for names within the delegated zone from a client with resolver access).
5. Sustain attack: Repeatedly serve crafted replies to maintain elevated CPU consumption on the Unbound process, degrading its ability to serve legitimate DNS queries (GitHub Advisory, NLnet Labs Advisory).

• Network: Elevated volume of DNS queries to a specific delegated zone or nameserver; unusual DNS response messages with abnormally complex or deeply nested domain name compression structures.
• Process: Sustained high CPU utilization by the unbound process without a corresponding spike in query volume; increased latency or timeouts on DNS resolution for legitimate clients.
• Logs: Unbound query logs showing repeated resolution attempts for names within a specific delegated zone; potential log entries indicating slow or stalled resolution threads.

Upgrade NLnet Labs Unbound to version 1.26.2 or later, which introduces an aggregate inbound decompression-work budget to limit CPU exposure from chained compression pointers. As a configuration-based workaround, restrict recursive query access to trusted clients only (e.g., via Unbound's access-control directive) to reduce the attack surface by limiting who can trigger resolution against attacker-controlled authorities (GitHub Advisory, NLnet Labs Advisory).