Denial of Service Vulnerability in Unbound DNS Resolver by NLnet Labs
CVE-2026-44390

6.9MEDIUM

Key Information:

Vendor

Nlnet Labs

Status
Unbound
Vendor
CVE Published:
20 May 2026

What is CVE-2026-44390?

A vulnerability in the Unbound DNS resolver allows attackers to exploit large Resource Record sets (RRsets) in malicious upstream responses. When Unbound attempts to apply name compression to these responses, it may become unresponsive due to the unbounded nature of the operation. Particularly, if the RRsets do not share any suffix above the root, Unbound's performance is severely impacted, leading to potential denial of service. This issue has been addressed in Unbound version 1.25.1, which introduces a fix to increment the compression counter correctly, thus preventing prolonged CPU locking and improving overall resilience against such attacks.

Affected Version(s)

Unbound 0 < 1.25.1

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44390...
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qifan Zhang (Palo Alto Networks)
.