CVE-2026-41292: Nlnetlabs Unbound DoS Vulnerability

CVE-2026-41292 Overview

CVE-2026-41292 is a denial of service vulnerability in NLnet Labs Unbound, an open-source validating, recursive, and caching DNS resolver. The flaw exists in versions up to and including 1.25.0. Attackers can send DNS queries containing excessively long lists of Extended DNS (EDNS) options. Unbound threads become tied up parsing the options and constructing internal data structures for each one. Coordinated query floods can degrade resolver performance or fully exhaust available worker threads. The issue is tracked under CWE-407: Inefficient Algorithmic Complexity. NLnet Labs released Unbound 1.25.1 with a fix that caps acceptable incoming EDNS options at 100.

Critical Impact
Remote, unauthenticated attackers can degrade or deny DNS resolution services by flooding Unbound with EDNS option-heavy queries.

Affected Products

NLnet Labs Unbound versions up to and including 1.25.0
Systems using Unbound as a recursive DNS resolver
DNS infrastructure relying on Unbound for caching and validation

Discovery Timeline

2026-05-20 - CVE-2026-41292 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-41292

Vulnerability Analysis

Unbound supports EDNS(0), an extension mechanism that allows DNS clients and servers to include additional options in queries and responses. When Unbound receives a query, it iterates through the EDNS options list and allocates internal structures to track each option. The implementation in versions up to 1.25.0 did not enforce a reasonable upper bound on the number of options per query.

An attacker can craft DNS queries that include thousands of EDNS options in a single packet. Each option forces the resolver thread to perform parsing and memory allocation work. The processing time grows with the number of options, monopolizing worker threads. Coordinated query floods from multiple sources can exhaust the resolver's worker pool and prevent legitimate clients from receiving responses.

Root Cause

The root cause is missing input validation on the count of EDNS options accepted per query. Unbound's option parsing loop trusted attacker-controlled input length without enforcing a ceiling. This pattern aligns with CWE-407, where inputs trigger disproportionately expensive processing. The patch in 1.25.1 introduces a hard limit of 100 EDNS options per incoming query.

Attack Vector

Exploitation requires only the ability to send DNS queries to a vulnerable Unbound instance. No authentication is required. Public-facing recursive resolvers and internal resolvers reachable from untrusted networks are the primary targets. The attacker sends UDP or TCP DNS queries crafted with a long EDNS option list. Distributed sources amplify the effect, holding multiple Unbound threads hostage simultaneously until resolution capacity collapses.

No verified exploit code is publicly available. Refer to the NLnet Labs CVE-2026-41292 Advisory for technical details from the vendor.

Detection Methods for CVE-2026-41292

Indicators of Compromise

DNS queries containing abnormally large EDNS option counts arriving at Unbound instances
Sudden spikes in Unbound thread utilization without corresponding increases in resolved query volume
Increased query latency or timeouts reported by downstream clients
Worker thread saturation reflected in unbound-control stats output

Detection Strategies

Monitor Unbound runtime statistics for elevated num.query.edns.present counts paired with stalled response rates
Capture sample DNS traffic with tcpdump or dnstap and inspect EDNS OPT records for unusually long option lists
Alert on processes where Unbound CPU consumption rises sharply while queries-per-second to clients drops

Monitoring Recommendations

Enable dnstap logging on Unbound and forward records to a central analytics platform for query inspection
Track resolver health metrics (queries handled, thread wait times, dropped queries) and set thresholds for anomaly alerts
Correlate DNS query telemetry with network flow data to identify sources sending option-heavy queries

How to Mitigate CVE-2026-41292

Immediate Actions Required

Upgrade Unbound to version 1.25.1 or later on all recursive resolver hosts
Restrict access to recursive resolvers using ACLs so only trusted client networks can query them
Place rate limiting in front of public-facing resolvers to constrain abusive query volume

Patch Information

NLnet Labs released Unbound 1.25.1 containing the fix. The patch enforces a maximum of 100 EDNS options per incoming query, ensuring that malformed or abusive queries are rejected before consuming significant thread resources. Operators running packaged builds should track their distribution's security advisories for backported updates. See the NLnet Labs CVE-2026-41292 Advisory for the official release notice.

Workarounds

Limit Unbound exposure to untrusted networks using firewall rules until patching is complete
Configure access-control directives in unbound.conf to allow queries only from defined client subnets
Apply network-level DNS rate limiting on perimeter devices to throttle suspicious query bursts

bash

# Verify installed Unbound version
unbound -V | head -n 1

# Example access-control restriction in unbound.conf
server:
    access-control: 0.0.0.0/0 refuse
    access-control: 10.0.0.0/8 allow
    access-control: 192.168.0.0/16 allow

# Reload configuration after changes
unbound-control reload