CVE-2026-80225

NLnetLabs Unbound up to and including 1.26.0 has a degradation-of-service flaw in its TCP and DNS-over-TLS (DoT) reading procedure, which performs consecutive reads from a connection without any limit (CWE-770). An attacker who opens a TCP/DoT connection and continuously streams queries for distinct, uncached names faster than the server can write responses can monopolize a single worker's entire event loop for as long as its writes stay ahead of the drain. The attacker gains the ability to slow or stall DNS resolution handled by that worker, degrading availability only (CVSS 5.3, availability impact low, no confidentiality or integrity impact). All Unbound deployments with TCP or DoT service enabled are affected, including the many ISP, enterprise and firewall/router-bundled instances. No public proof-of-concept or known in-the-wild exploitation has been reported, and the issue is not on CISA's KEV list.

What to do: Upgrade all Unbound instances to the first release after 1.26.0 as published by NLnetLabs (check the NLnetLabs advisory for the fixed version). As an interim mitigation, restrict which clients can reach the TCP/53 and DoT (853) listeners using access-control rules or firewall policy, and limit queries or connections per client where supported. Operators should monitor per-worker CPU and DNS response latency for signs of a single connection monopolizing an event loop.