Cloudanix VulnDB

CVE-2026-96405

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Oct 21, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Unbound DNS software lets attackers send specially crafted responses that make the server use far more processing power than normal, slowing it down or making it unavailable.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unbound performs per-name compression-pointer traversal limits but lacks an aggregate inbound decompression budget, allowing a high volume of chained pointers in a single DNS message to consume excessive CPU during recursive resolution.

Why it matters to the business

Attackers can cause sustained high CPU load on Unbound resolvers, degrading query performance and potentially disrupting DNS service availability for users and applications that rely on the resolver.

How an attack unfolds

An attacker with the ability to send recursive queries and control an authoritative server under a delegated zone crafts responses containing many chained compression pointers; when Unbound processes the response during resolution it follows the pointers repeatedly, exhausting CPU without an overall work limit.

How to fix it

Upgrade to the first patched release of Unbound once available; until then apply any vendor-recommended configuration limits on query depth or response size and monitor CPU usage closely.

How to confirm the fix worked

After upgrade, confirm the new version string, re-test with crafted responses containing chained pointers to verify CPU usage remains bounded, and review release notes for the aggregate budget implementation.

Typical attack path

  1. Obtain recursive query access to the target Unbound instance
  2. Register or compromise an ordinarily delegated authoritative domain
  3. Configure the authority to return responses with long chains of compression pointers
  4. Trigger recursive queries that elicit the crafted responses
  5. Observe repeated pointer traversal consuming CPU on the resolver

How to detect it

Inspect DNS query and response logs for unusually large numbers of compression pointers or high-frequency queries returning from the same delegated zones; correlate with spikes in resolver CPU usage and check process accounting for sustained high utilization during DNS handling.

What your security team should do

  • Monitor vendor announcements for the availability of a fixed Unbound release and schedule upgrade within maintenance windows
  • Implement network-level rate limiting or response-size filtering on inbound DNS traffic to reduce exposure
  • Add resolver CPU and query-latency alerts to detect anomalous load patterns
  • Review recursive-query ACLs to ensure only trusted clients can trigger resolution of external zones

The record

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities