CVE-2026-41292
EUVD-2026-3107820.05.2026, 10:16
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| nlnetlabs | unbound | 𝑥 < 1.25.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:1.24.2-7.el10_2.2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8 | 0:1.16.2-5.12.el8_10 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 0:1.24.2-3.el9_8.2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Hardened Images | 1.25.1-2.hum1 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libunbound8 |
| ||||||||||||||||
| unbound-anchor |
| ||||||||||||||||
| unbound-devel |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||
|---|---|---|---|---|---|
| python3-unbound |
| ||||
| unbound |
| ||||
| unbound-devel |
| ||||
| unbound-dracut |
| ||||
| unbound-libs |
|
Amazon Linux Releases
Amazon Package | |||||
|---|---|---|---|---|---|
| python2-unbound |
| ||||
| python3-unbound |
| ||||
| python3-unbound-debuginfo |
| ||||
| unbound |
| ||||
| unbound-anchor |
| ||||
| unbound-anchor-debuginfo |
| ||||
| unbound-debuginfo |
| ||||
| unbound-debugsource |
| ||||
| unbound-devel |
| ||||
| unbound-libs |
| ||||
| unbound-libs-debuginfo |
| ||||
| unbound-utils |
| ||||
| unbound-utils-debuginfo |
|
Common Weakness Enumeration
- CWE-407 - Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
- CWE-1050 - Excessive Platform Resource Consumption within a LoopThe software has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
References