CVE-2026-85501: DNSSEC ReTrap DOS Vulnerability

CVE-2026-85501 Overview

CVE-2026-85501 describes a class of algorithmic complexity vulnerabilities in the Domain Name System Security Extensions (DNSSEC) validation logic of NLnet Labs Unbound, tracked under the research name ReTrap. Versions up to and including 1.26.0 are affected. Malicious authoritative zones can force the resolver into disproportionate computational work during signature validation. The result is service degradation on the resolver, impacting availability for legitimate DNS clients. The disclosure covers four distinct exploitation vectors: TagTrap, DelegationTrap, NsecTrap, and AdditionalTrap.

Critical Impact
Remote unauthenticated attackers can degrade Unbound resolver availability by serving crafted DNSSEC responses that trigger costly validation loops.

Affected Products

NLnet Labs Unbound versions up to and including 1.26.0
Deployments performing DNSSEC validation of the ADDITIONAL section (default configuration)
Recursive resolvers serving clients that query attacker-controlled zones

Discovery Timeline

2026-09-16 - CVE-2026-85501 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85501

Vulnerability Analysis

The ReTrap research identifies four algorithmic complexity attacks [CWE-770: Allocation of Resources Without Limits or Throttling] against DNSSEC validation in Unbound. Each vector exploits the resolver's obligation to validate cryptographic records supplied by an authoritative server, without effective bounds on the work performed per response.

TagTrap abuses the triple (Zone, Algorithm, KeyTag) matching mechanism. A malicious zone returns responses containing numerous mismatched DNSKEY, RRSIG, and DS records, forcing the resolver to iterate cryptographic matching across combinations that will never validate.

DelegationTrap targets chain-of-trust construction. Building trust requires iterative validation of DNSKEY and DS records from the root zone downward. Deeply nested attacker-controlled delegations multiply the validation work.

NsecTrap uses responses containing excessive invalid NSEC records for authenticated denial-of-existence. The resolver validates each record before rejecting the response.

AdditionalTrap leverages Unbound's default behavior of DNSSEC-validating records in the ADDITIONAL section. Attackers pad this section with signed records to consume validation cycles unrelated to the client's original query.

Root Cause

The underlying flaw is missing upper bounds on the number of cryptographic operations Unbound performs per response. DNSSEC validation loops iterate over attacker-controlled record sets without cost accounting, allowing a single response to consume disproportionate CPU.

Attack Vector

Exploitation requires only that a victim resolver be induced to query a domain served by an attacker-controlled authoritative name server. No authentication or user interaction is required. The attacker crafts DNSSEC responses containing large volumes of mismatched keys, signatures, delegations, NSEC records, or ADDITIONAL section entries. Sustained querying amplifies the CPU cost and degrades resolver throughput for all clients.

No public proof-of-concept exploit is currently listed for CVE-2026-85501. See the NLnet Labs CVE-2026-85501 advisory for the vendor's technical description.

Detection Methods for CVE-2026-85501

Indicators of Compromise

Sustained high CPU utilization on Unbound processes correlated with queries to specific external zones
DNS responses from external authoritative servers containing abnormally large DNSKEY, RRSIG, DS, or NSEC record sets
Growth in resolver query latency and SERVFAIL rates without a corresponding increase in client query volume
Repeated recursive queries into deeply nested delegation chains under uncommon top-level domains

Detection Strategies

Monitor Unbound's built-in statistics (unbound-control stats) for spikes in num.query.tcp, validation failures, and average response processing time
Correlate resolver CPU spikes with outbound DNS traffic destinations to identify abusive authoritative servers
Alert on responses exceeding a threshold count of RRSIG or NSEC records per message

Monitoring Recommendations

Ingest Unbound query and validation logs into a centralized analytics platform for baseline and anomaly analysis
Track DNSSEC validation failures per upstream zone and flag zones responsible for disproportionate validation cost
Establish alerting on sustained CPU exhaustion of resolver hosts, which is the primary observable impact of ReTrap

How to Mitigate CVE-2026-85501

Immediate Actions Required

Upgrade NLnet Labs Unbound to a version later than 1.26.0 that includes the ReTrap mitigations once available
Review the NLnet Labs advisory for vendor-recommended configuration changes
Restrict recursive service to trusted client networks to limit the pool of queries that can trigger malicious lookups
Deploy rate limiting on outbound queries to unfamiliar authoritative servers

Patch Information

NLnet Labs has published an advisory for CVE-2026-85501 at nlnetlabs.nl. Administrators should consult that advisory for the fixed release version and apply upgrades across all recursive resolver instances. Confirm the running version with unbound-control status after deployment.

Workarounds

Disable DNSSEC validation of the ADDITIONAL section to neutralize the AdditionalTrap vector where operationally acceptable
Configure resolver resource limits, including CPU cgroups and per-query timeouts, to contain the impact of expensive validations
Deploy multiple resolver instances behind a load balancer so that degradation of one instance does not deny service to clients
Consider response size and record count limits at network security devices in front of resolvers

bash

# Verify installed Unbound version and apply upgrade
unbound-control status | grep version

# Example: disable validation of the ADDITIONAL section in unbound.conf
# (evaluate operational impact before applying)
server:
    harden-glue: yes
    val-clean-additional: yes