CVE-2026-80225: NLnetLabs Unbound DoS Vulnerability

CVE-2026-80225 Overview

CVE-2026-80225 affects NLnet Labs Unbound, an open-source recursive DNS resolver. Versions up to and including 1.26.0 contain a resource exhaustion flaw in the TCP and DNS-over-TLS (DoT) reading procedure. The code path performs consecutive reads without any upper bound. An attacker who streams a sustained sequence of distinct uncached names over a single TCP or DoT connection can monopolize an entire worker's event loop. The condition persists as long as the attacker's writes stay ahead of the drain, degrading resolver performance for legitimate clients. The weakness is classified under [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
A single unauthenticated network client can sustain a stream of uncached queries over TCP/DoT and starve a worker thread, degrading DNS resolution service.

Affected Products

NLnet Labs Unbound versions up to and including 1.26.0
Deployments using TCP transport for DNS queries
Deployments using DNS-over-TLS (DoT) for encrypted DNS transport

Discovery Timeline

2026-09-16 - CVE-2026-80225 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-80225

Vulnerability Analysis

Unbound processes inbound DNS queries on a per-worker basis, with each worker driving an event loop that services multiple connections. The TCP and DoT reading procedure loops on read() operations for a connection whenever data is available. The implementation does not bound how many consecutive read and query-processing iterations occur before yielding back to the event loop.

An attacker that opens a TCP or DoT connection and pipelines a continuous stream of DNS queries for distinct, uncached names forces the worker to repeatedly resolve unique records. Because the write rate outpaces the drain, the worker never exits the read loop for that connection. Other clients bound to the same worker experience latency or fail to receive responses. The attack requires no authentication and no user interaction.

Root Cause

The root cause is the absence of a per-connection cap on consecutive reads within the TCP/DoT input path [CWE-770]. Without a bound, connection fairness collapses when one peer sustains a high query rate against uncached names. Uncached names amplify the effect because each query triggers recursive resolution rather than a cheap cache lookup.

Attack Vector

The attack is delivered over the network to any TCP or DoT listener exposed by Unbound. The attacker establishes a single connection and streams DNS queries for randomized or attacker-generated labels that will not be present in the resolver cache. The attacker maintains the write rate to keep the worker's read loop saturated. Details are documented in the NLnet Labs CVE-2026-80225 Description.

Detection Methods for CVE-2026-80225

Indicators of Compromise

Sustained inbound TCP/53 or TCP/853 (DoT) connections carrying continuous streams of queries for unique labels under a common parent domain.
Worker threads reporting elevated CPU time and event-loop stalls on the Unbound process.
Increased query latency and TCP/DoT timeouts observed by downstream clients while UDP traffic still resolves.

Detection Strategies

Alert on TCP or DoT clients whose per-connection query rate exceeds baseline for extended windows.
Correlate a high ratio of SERVFAIL or cache-miss responses to a single source IP over TCP/DoT.
Monitor Unbound's unbound-control stats counters for spikes in num.query.tcp, num.query.tls, and per-thread request counts.

Monitoring Recommendations

Export Unbound statistics to a metrics pipeline and alert on divergence between worker threads.
Log source IP and query patterns for TCP/DoT sessions and review long-lived connections.
Track connection duration and query-per-connection distributions to identify outliers.

How to Mitigate CVE-2026-80225

Immediate Actions Required

Upgrade Unbound to a fixed release published by NLnet Labs after version 1.26.0.
Restrict TCP/53 and TCP/853 exposure to trusted client networks where feasible.
Enforce per-client connection and query-rate limits at the network edge or load balancer.

Patch Information

Refer to the NLnet Labs CVE-2026-80225 Description for the fixed version and upgrade guidance. Operators should track the NLnet Labs Unbound release notes for the corresponding patched build.

Workarounds

Reduce tcp-idle-timeout and set aggressive tcp-connection-limit values in unbound.conf to cap per-source TCP concurrency.
Apply firewall rate limits on TCP/53 and TCP/853 to constrain packets-per-second from any single source.
Place Unbound behind a DNS-aware proxy or load balancer that enforces query-rate policies per connection.

bash

# Example unbound.conf hardening for TCP/DoT abuse
server:
    tcp-connection-limit: 10 100
    tcp-idle-timeout: 5000
    tcp-reuse-timeout: 5000
    ratelimit: 1000
    ip-ratelimit: 200