Log in Start free

Vulnerability · Published May 20, 2026 · Assigned by NLnet Labs

CVE-2026-41292Long list of incoming EDNS options degrades performance

High 7.5

In plain English

A high-severity resource allocation without limits in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 44.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10python3-unbound1.24.2-7.el10_2.2ALSA-2026:36320
AlmaLinux:8python3-unbound1.16.2-5.12.el8_10ALSA-2026:37282
AlmaLinux:9python3-unbound1.24.2-3.el9_8.2ALSA-2026:36777
AlmaLinux:10unbound1.24.2-7.el10_2.2ALSA-2026:36320
AlmaLinux:8unbound1.16.2-5.12.el8_10ALSA-2026:37282
AlmaLinux:9unbound1.24.2-3.el9_8.2ALSA-2026:36777
AlmaLinux:10unbound-anchor1.24.2-7.el10_2.2ALSA-2026:36320
AlmaLinux:10unbound-devel1.24.2-7.el10_2.2ALSA-2026:36320
AlmaLinux:8unbound-devel1.16.2-5.12.el8_10ALSA-2026:37282
AlmaLinux:9unbound-devel1.24.2-3.el9_8.2ALSA-2026:36777
AlmaLinux:10unbound-dracut1.24.2-7.el10_2.2ALSA-2026:36320
AlmaLinux:9unbound-dracut1.24.2-3.el9_8.2ALSA-2026:36777
AlmaLinux:10unbound-libs1.24.2-7.el10_2.2ALSA-2026:36320
AlmaLinux:8unbound-libs1.16.2-5.12.el8_10ALSA-2026:37282
AlmaLinux:9unbound-libs1.24.2-3.el9_8.2ALSA-2026:36777
AlmaLinux:10unbound-utils1.24.2-7.el10_2.2ALSA-2026:36320
Alpine:v3.22unbound1.25.2-r0ALPINE-CVE-2026-41292
Alpine:v3.23unbound1.25.2-r0ALPINE-CVE-2026-41292
Alpine:v3.24unbound1.25.1-r0ALPINE-CVE-2026-41292
Debian:12unboundno fix listedDEBIAN-CVE-2026-41292
Debian:13unbound1.22.0-2+deb13u3DEBIAN-CVE-2026-41292
Debian:14unbound1.25.1-1DEBIAN-CVE-2026-41292
Rocky Linux:10unbound0:1.24.2-7.el10_2.2RLSA-2026:36320
Rocky Linux:8unbound0:1.16.2-5.12.el8_10RLSA-2026:37282
Rocky Linux:9unbound0:1.24.2-3.el9_8.2RLSA-2026:36777
Ubuntu:22.04:LTSunbound1.13.1-1ubuntu5.15UBUNTU-CVE-2026-41292
Ubuntu:24.04:LTSunbound1.19.2-1ubuntu3.8UBUNTU-CVE-2026-41292
Ubuntu:25.10unbound1.22.0-2ubuntu2.3UBUNTU-CVE-2026-41292
Ubuntu:26.04:LTSunbound1.24.2-1ubuntu2.1UBUNTU-CVE-2026-41292

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound 0 – before 1.25.1

Weakness: CWE-407, CWE-770, CWE-1050 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References