Algorithmic Complexity Vulnerabilities in NLnet Labs Unbound
CVE-2026-85501

5.3MEDIUM

Key Information:

Vendor

Nlnet Labs

Status
Unbound
Vendor
CVE Published:
16 September 2026

What is CVE-2026-85501?

The vulnerabilities identified in NLnet Labs Unbound, referred to collectively as 'ReTrap', facilitate algorithmic complexity attacks on DNSSEC. These vulnerabilities exploit the handling of malicious DNS responses, leading to degradation of service. Specifically, 'TagTrap' significantly compromises resolvers by matching mismatched DNSKEY, RRSIG, and DS records. The 'DelegationTrap' requires iterative validation of records from the root zone downward, resulting in computational overhead for deeply nested domains. Furthermore, 'NsecTrap' forces resolvers to validate excessive invalid NSEC records, while 'AdditionalTrap' can waste validation resources by incorrectly validating the ADDITIONAL section under default settings. This combination of vulnerabilities presents critical performance and security risks for Unbound users.

Affected Version(s)

Unbound 0 < 1.26.1

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zuyao Xu (Nankai University, AOSP Lab)
Xiang Li (Nankai University, AOSP Lab)
Qifan Zhang (Palo Alto Networks)
.