CVE-2026-80225

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.

Score

CVSS 3.1 7.5 High

Status

Analyzed - sep@nlnetlabs.nl

Published

2026-09-16

Last modified

2026-09-16

Weaknesses

CWE-770

Affected products

• Unbound (Nlnet Labs)
• Unbound (Nlnetlabs)

References

• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt