AI analysis
CVE-2026-85501 covers the 'ReTrap' class of algorithmic complexity attacks against DNSSEC validation in NLnet Labs Unbound up to and including 1.26.0, where maliciously crafted DNS data forces the resolver into disproportionately expensive validation work. An attacker who controls a zone (or can make a client trigger lookups into one) can abuse several mechanisms: TagTrap (floods of mismatched DNSKEY, RRSIG and DS records against the (Zone, Algo, KeyTag) matching logic), DelegationTrap (deeply nested domains that require iterative DNSKEY/DS validation from the root downward), NsecTrap (large numbers of invalid NSEC records that each must be validated), and AdditionalTrap (Unbound by default validates the ADDITIONAL section, which can be padded to waste validation resources). The result is CPU/resource exhaustion and degraded DNS resolution, i.e., denial of service; the assigned CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, A:L) indicates no confidentiality or integrity impact. Any Unbound deployment performing DNSSEC validation is affected, including ISP, enterprise and OS-bundled resolvers. No public proof-of-concept or confirmed in-the-wild exploitation is known and it is not in CISA KEV; note that some media coverage describes a critical/RCE Unbound flaw, but the documented impact for this CVE is availability only.
What to do: Upgrade Unbound to a release newer than 1.26.0 once NLnet Labs publishes the patched version, and check the vendor advisory for the exact fixed release. Interim mitigations: restrict recursion (access-control) to trusted clients, apply query/response rate limiting, and consider disabling validation of the ADDITIONAL section if operationally feasible; only resolvers with DNSSEC validation enabled are affected. Monitor resolver CPU and query patterns for signs of complexity-based DoS.
Affected
| NLnet Labs Unbound | up to and including 1.26.0 |
Estimated exposure
mass≈ millions of resolver deployments worldwide, with roughly 100k+ internet-exposed Unbound instances — Unbound is one of the most widely deployed open-source validating recursive resolvers (bundled with major Unix-like distributions and common in ISP/enterprise stacks), and historical public internet scans have identified hundreds of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.