CVE-2026-42534

What it actually does

CVE-2026-42534 is a denial-of-service weakness in NLnet Labs Unbound through version 1.25.0. The flaw is in Unbound's query “jostle” logic, which is intended to replace old, slow recursive lookups when the resolver reaches its per-thread outstanding-query limit. Duplicate retransmissions of the same query can incorrectly refresh the query age, causing genuinely old slow queries to appear newer than they are. As a result, slow or malicious upstream authoritative responses can keep resolver work slots occupied longer than intended, degrading recursive resolution performance. Cached answers and local-zone/local-data responses are not directly affected, but uncached recursive lookups can become slow or fail under coordinated load.

Why it matters to the business

Organizations using vulnerable Unbound resolvers may experience degraded DNS resolution for uncached domains, which can cause application delays, intermittent service failures, monitoring noise, and user-visible connectivity problems. The issue is remotely triggerable by an unauthenticated attacker who can send queries to the resolver and control or influence a slow authoritative DNS server. The CVSS score is moderate and EPSS is currently low with no reported KEV or ransomware association, but internet-exposed recursive resolvers, shared resolver infrastructure, and high-volume DNS environments should still treat this as operationally important because DNS degradation can cascade into broad service instability.

How an attack unfolds

An attacker first identifies a vulnerable Unbound resolver that accepts queries from the attack source or from a reachable client population. The attacker also operates or controls an authoritative DNS server for one or more domains and configures it to respond slowly, inconsistently, or maliciously to recursive lookups. The attacker then sends many queries for uncached names under those controlled domains. As Unbound waits on slow upstream responses, the number of outstanding recursive queries approaches the configured num-queries-per-thread limit. The attacker retransmits duplicate queries for the same names, causing the vulnerable jostle aging calculation to use the timestamp of the latest duplicate rather than the original query start time. This prevents old slow-running queries from being selected as replacement candidates as intended. Under sustained or coordinated attack, resolver worker capacity is consumed by slow queries, resulting in degraded or denied recursive resolution for legitimate uncached lookups.

How to fix it

Upgrade NLnet Labs Unbound to version 1.25.1 or later, which fixes the jostle logic by tracking an initial non-updatable query start time. If immediate upgrade is not possible, reduce exposure by restricting who can query recursive resolvers, blocking open-recursive access from untrusted networks, enforcing DNS response-rate and query-rate controls at network edges where appropriate, and monitoring/tuning resolver capacity settings such as num-queries-per-thread only as a temporary operational mitigation. Avoid relying solely on increased capacity, because it may raise the attack cost but does not correct the vulnerable aging behavior. Ensure all downstream packages, containers, appliances, and OS distributions embedding Unbound receive the vendor-provided patched build.

How to confirm the fix worked

Confirm the installed Unbound version reports 1.25.1 or later using package inventory, the system package manager, or the Unbound binary version output. Verify that internet-facing resolvers are not configured as open recursive resolvers unless explicitly intended. Review configuration for access-control rules limiting recursion to trusted client networks. After patching, perform controlled testing with slow authoritative responses and duplicate queries in a lab or maintenance window to confirm the resolver does not allow slow duplicate queries to monopolize the request list. Monitor Unbound statistics before and after remediation for reductions in requestlist.exceeded, requestlist.overwritten, high requestlist.current values, timeouts, and SERVFAIL spikes during abnormal query bursts.

Typical attack path

1. Identify an Unbound resolver running version 1.25.0 or earlier that will process attacker-supplied DNS queries.
2. Register or control a domain and its authoritative DNS server infrastructure.
3. Configure the authoritative server to delay, stall, or otherwise provide slow responses to recursive queries.
4. Send high volumes of uncached DNS queries for names under the attacker-controlled domain to the vulnerable resolver.
5. Retransmit duplicate queries so the vulnerable query-aging logic refreshes timestamps incorrectly.
6. Drive the resolver toward the num-queries-per-thread outstanding-query limit.
7. Sustain the condition so legitimate uncached recursive lookups are delayed, fail, or receive SERVFAIL/timeouts.

How to detect it

Look for signs of DNS resolution degradation rather than a single definitive exploit artifact. Useful sources include Unbound operational logs, Unbound statistics from unbound-control stats or stats_noreset, DNS query logs, packet captures, resolver host performance metrics, firewall or load balancer flow logs, and monitoring data for application DNS failures. Focus on time windows with elevated outstanding recursive requests, request-list exhaustion, timeouts, SERVFAIL responses, and high cache-miss traffic. Investigate repeated or retransmitted queries for uncached names under the same domains, especially when those domains' authoritative name servers respond slowly or intermittently. Correlate spikes in requestlist.exceeded or requestlist.overwritten with client IPs generating repeated duplicate queries and with outbound resolver traffic to slow authoritative servers. Because no public KEV exploitation or named threat actor activity is currently associated with this issue, detection should be behavior-based: abnormal query repetition, slow attacker-controlled authoritative responses, and resolver request-list pressure occurring together are the strongest indicators.

• requestlist.exceeded
• requestlist.overwritten
• requestlist.current.all
• requestlist.current.recursion
• num.queries_timed_out
• SERVFAIL
• num-queries-per-thread

What your security team should do

• Upgrade all Unbound deployments running 1.25.0 or earlier to 1.25.1 or later as the primary fix.
• Prioritize externally reachable, shared, high-throughput, and business-critical recursive resolvers first.
• Audit resolver access-control settings to ensure recursion is limited to trusted networks and clients.
• Add monitoring for outstanding request-list pressure, timeout spikes, SERVFAIL increases, and repeated queries for uncached names under the same domains.
• Review DNS firewall, rate-limiting, and edge controls for unusually high query volumes or repeated retransmissions from individual clients or networks.
• Investigate recent resolver performance incidents since publication for evidence of slow authoritative domains combined with duplicate query bursts.
• Track operating system, container, and appliance vendor advisories to ensure embedded Unbound packages receive the fixed release.