CVE-2026-96405

Awaiting Analysis Awaiting Analysis - Queue

Unbound DNS Server Compression-Pointer CPU Exhaustion

Publication date: 2026-10-21

Last updated on: 2026-10-29

Assigner: NLnet Labs

Description

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-96405

EUVD

EUVD-2026-107153

Affected Vendors & Products

Vendor	Product	Version / Range
NLnet Labs	Unbound	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-96405 is a DNS decompression vulnerability affecting Unbound DNS software. It occurs because Unbound lacks an aggregate inbound decompression-work budget, allowing excessive CPU usage when processing specially crafted replies with many chained compression pointers. This degrades Unbound's general performance.

Detection Guidance

Monitor Unbound CPU usage during DNS queries. Check for excessive CPU consumption when processing replies from upstream servers or zone transfers. Use system monitoring tools like top, htop, or ps to observe Unbound process behavior.

Impact Analysis

A malicious actor with recursive-query access and control over a delegated authority could exploit this to send crafted replies, causing high CPU usage and degraded performance in Unbound. This may lead to slower DNS resolution or service disruptions.

Compliance Impact

This vulnerability primarily causes performance degradation due to excessive CPU usage from crafted DNS replies, which does not directly violate GDPR or HIPAA. However, it could indirectly impact compliance by degrading service availability or response times for systems handling sensitive data, potentially affecting data processing timeliness under GDPR or operational reliability under HIPAA.

Mitigation Strategies

Upgrade Unbound to version 1.26.2 or later. Apply the available patches for version 1.26.1 if upgrading is not immediately possible. Limit recursive-query access to trusted sources only.

Hi! I’m here to help you understand CVE-2026-96405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...