CVE-2026-42534: Nlnetlabs Unbound DOS Vulnerability

CVE-2026-42534 Overview

CVE-2026-42534 affects NLnet Labs Unbound DNS resolver up to and including version 1.25.0. The vulnerability resides in the jostle logic that manages slow-running queries when num-queries-per-thread reaches its limit. Retransmits of the same query refresh the timestamp used for aging, preventing the jostle logic from identifying slow queries as candidates for replacement. An attacker who can issue queries to a vulnerable Unbound instance and control an authoritative name server that responds slowly or maliciously can degrade resolution performance. Coordinated attacks can escalate the impact to a denial of resolution service. Cache and local data response performance remain unaffected. NLnet Labs released Unbound 1.25.1 with a fix.

Critical Impact

Remote attackers can degrade DNS resolution performance and potentially cause denial of resolution service by exploiting the duplicate-query timestamp handling in Unbound's jostle logic.

Affected Products

• NLnet Labs Unbound versions up to and including 1.25.0
• Deployments using default num-queries-per-thread jostle behavior
• Recursive resolver installations exposed to attacker-influenced upstream name servers

Discovery Timeline

• 2026-05-20 - CVE-2026-42534 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-42534

Vulnerability Analysis

Unbound enforces a per-thread limit on outstanding recursive queries through the num-queries-per-thread setting. When the limit is reached, Unbound applies jostle logic: incoming queries can replace existing queries that are both slow to resolve and within the oldest half of currently active queries. The aging decision relies on a timestamp associated with each query. The vulnerability stems from how the resolver updates this timestamp when duplicate queries arrive for the same in-flight resolution. Rather than retaining the start time of the original query, Unbound applies the timestamp of the most recent duplicate. This causes long-running queries to appear young and exempts them from replacement. The flaw maps to [CWE-440: Expected Behavior Violation].

Root Cause

The jostle logic depends on monotonically tracked query age. The resolver overwrites the existing query's start time when a matching duplicate arrives during ongoing resolution. Repeated duplicates renew the apparent age indefinitely. Slow queries that should age out and yield slots to new work instead persist past their intended lifetime, undermining the protective intent of the jostle mechanism.

Attack Vector

The attacker requires two capabilities: the ability to send queries to the target Unbound instance and control over an authoritative server that responds slowly or not at all. The attacker queries names within their controlled zone and retransmits the same query repeatedly. Each retransmit refreshes the timestamp of the in-flight resolution. The attacker fills outstanding query slots with persistently young-looking entries. Legitimate clients are denied resolution capacity once num-queries-per-thread saturates. The attack requires no authentication and operates entirely over the network.

No verified public proof-of-concept code is available. Refer to the NLnet Labs CVE-2026-42534 Advisory for vendor technical details.

Detection Methods for CVE-2026-42534

Indicators of Compromise

• Sustained saturation of num-queries-per-thread on Unbound resolvers without correlating legitimate traffic spikes
• High volumes of repeated identical queries from a small set of clients targeting the same external domain
• Authoritative name servers in upstream queries exhibiting abnormally long response times or no responses
• Rising client-visible SERVFAIL or query timeout rates while cache hit performance remains normal

Detection Strategies

• Monitor Unbound unbound-control stats output for elevated num.query.tcp, num.queries, and recursion replies pending counters relative to baseline
• Correlate per-source query rates against per-destination-domain query rates to identify retransmit-heavy patterns
• Alert when slow upstream resolution times persist across many concurrent queries for a single zone
• Compare client resolution latency against cache hit latency to confirm recursion-path degradation

Monitoring Recommendations

• Enable extended statistics in Unbound and ingest metrics into a centralized observability platform
• Track outbound query duration distributions per upstream authoritative server
• Log and review repeated identical client queries with high retransmit counts
• Establish baselines for recursion queue depth and alert on sustained deviation

How to Mitigate CVE-2026-42534

Immediate Actions Required

• Upgrade Unbound to version 1.25.1 or later on all recursive resolver hosts
• Inventory all Unbound deployments, including container images and appliance firmware, to confirm versions in use
• Restrict recursion to authenticated or trusted client networks using access-control directives where feasible
• Review upstream query patterns for evidence of ongoing exploitation prior to patching

Patch Information

NLnet Labs released Unbound 1.25.1 containing the fix. The patch attaches an initial, non-updatable start time to incoming queries so that subsequent duplicates cannot reset the aging clock. The jostle logic then sees genuinely aged queries and replaces them as designed. Full vendor details are available in the NLnet Labs CVE-2026-42534 Advisory.

Workarounds

• Limit recursion exposure by binding Unbound to internal interfaces and enforcing strict access-control policies
• Increase num-queries-per-thread as a temporary measure to raise the saturation threshold, accepting higher memory usage
• Apply rate limiting at the network perimeter to constrain repeated identical queries from individual sources
• Deploy upstream egress filtering to block queries to known malicious authoritative servers

# Configuration example: verify version and restrict recursion in unbound.conf
unbound -V | head -n1

server:
    interface: 127.0.0.1
    access-control: 10.0.0.0/8 allow
    access-control: 0.0.0.0/0 refuse
    num-queries-per-thread: 4096