Log in Start free

Vulnerability · Published Sep 16, 2026 · Assigned by NLnet Labs

CVE-2026-80225Possible degradation of service from continuous queries on the same TCP/DoT connection

Medium 5.3

In plain English

A medium-severity resource allocation without limits in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 58.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12unboundno fix listedDEBIAN-CVE-2026-80225
Debian:13unbound1.26.1-0+deb13u1DEBIAN-CVE-2026-80225
Debian:14unbound1.26.1-1DEBIAN-CVE-2026-80225
Ubuntu:22.04:LTSunbound1.13.1-1ubuntu5.17UBUNTU-CVE-2026-80225
Ubuntu:22.04:LTSunbound1.13.1-1ubuntu5.17USN-8946-1
Ubuntu:24.04:LTSunbound1.19.2-1ubuntu3.12USN-8946-1
Ubuntu:24.04:LTSunbound1.19.2-1ubuntu3.12UBUNTU-CVE-2026-80225
Ubuntu:26.04:LTSunbound1.24.2-1ubuntu2.4USN-8946-1
Ubuntu:26.04:LTSunbound1.24.2-1ubuntu2.4UBUNTU-CVE-2026-80225
Ubuntu:26.10unboundno fix listedUBUNTU-CVE-2026-80225

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound 0 – before 1.26.1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References