AI analysis
NLnetLabs Unbound up to and including 1.26.0 has a degradation-of-service flaw in its TCP and DNS-over-TLS (DoT) reading procedure, which performs consecutive reads from a connection without any limit (CWE-770). An attacker who opens a TCP/DoT connection and continuously streams queries for distinct, uncached names faster than the server can write responses can monopolize a single worker's entire event loop for as long as its writes stay ahead of the drain. The attacker gains the ability to slow or stall DNS resolution handled by that worker, degrading availability only (CVSS 5.3, availability impact low, no confidentiality or integrity impact). All Unbound deployments with TCP or DoT service enabled are affected, including the many ISP, enterprise and firewall/router-bundled instances. No public proof-of-concept or known in-the-wild exploitation has been reported, and the issue is not on CISA's KEV list.
What to do: Upgrade all Unbound instances to the first release after 1.26.0 as published by NLnetLabs (check the NLnetLabs advisory for the fixed version). As an interim mitigation, restrict which clients can reach the TCP/53 and DoT (853) listeners using access-control rules or firewall policy, and limit queries or connections per client where supported. Operators should monitor per-worker CPU and DNS response latency for signs of a single connection monopolizing an event loop.
Affected
| NLnet Labs Unbound | up to and including 1.26.0 |
Estimated exposure
masslikely >1M deployments worldwide (default resolver in OPNsense/pfSense and common at ISPs), with hundreds of thousands of internet-exposed instances per public… — Unbound is one of the most widely deployed open-source validating recursive resolvers, shipped as the default resolver in popular firewall/router distributions and used by ISPs and enterprises, and internet-wide scans have long shown on…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.