CVE-2026-80225
published 2026-09-16CVE-2026-80225: In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.31%
24.4th percentile
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nlnet_labs | unbound | < 1.26.1 | 1.26.1 |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection
vendor_redhat·2026-09-16·CVSS 5.3
CVE-2026-80225 [MEDIUM] CWE-1050 unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection
unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection
A flaw was found in Unbound. A malicious actor can exploit a vulnerability in the TCP/DoT reading procedure, which lacks a limit on consecutive reads. By continuously streaming distinct uncached names over a TCP/DoT connection, an attacker can monopolize a worker's event loop. This can lead to a degradation of service, effectively causing a Denial of Service (DoS) for legitimate users.
Package: openshift/ose-rhel-coreos-8 (Red Hat OpenShift Container Platform 4) - Fix deferred
Package: openshift/ose-rhel-coreos-9 (Red Hat OpenShift Container Platform 4) - Fix deferred
GHSA
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads.
ghsa_unreviewed·2026-09-16
CVE-2026-80225 [MEDIUM] CWE-770 In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads.
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-80225 unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection [fedora-all]
bugzilla·2026-09-21·CVSS 5.3
CVE-2026-80225 [MEDIUM] CVE-2026-80225 unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection [fedora-all]
CVE-2026-80225 unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
Bugzilla
CVE-2026-80225 unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection
bugzilla·2026-09-16·CVSS 5.3
CVE-2026-80225 [MEDIUM] CVE-2026-80225 unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection
CVE-2026-80225 unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
Hackernews
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
blogs_hackernews·2026-09-17·CVSS 9.8
CVE-2026-81642 [CRITICAL] Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday.
An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution.
Unbound 1.26.1, released the same day, fixes the bug, tracked as CVE-2026-81642 , along with eight other flaws. One of the eight, CVE-2026-82717 , is a heap corruption bug in CNAME synthesis reported by Ben Morris of Anthropic. It could also lead to remote code
2026-09-16
Published