Inefficient Algorithmic Complexity in Unbound - CVE-2026-96405
Published: October 21, 2026
Vulnerability identifier: #VU156694
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96405
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through excessive CPU consumption and degraded resolver performance.
The vulnerability exists due to insufficient limits on aggregate decompression work in Unbound's DNS decompression processing when decompressing upstream replies and zone transfer packets. A remote attacker can supply specially crafted DNS replies containing many chained compression pointers to consume excessive CPU resources and degrade resolver performance.
Exploitation requires recursive-query access and control of an ordinarily delegated authority.
Affected software
Unbound
How to mitigate CVE-2026-96405
Install security update from vendor's website.
Unbound - update to 1.26.2