CVE-2026-85501

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.1

Description Algorithmic complexity attacks, researched as 'ReTrap', can lead to service degradation when malicious zones are used. These attacks include TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism is exploited via responses with numerous mismatched DNSKEY, RRSIG, and DS records; DelegationTrap, which causes computational overhead during the iterative validation of the chain-of-trust for deeply nested domains; NsecTrap, which forces the resolver to validate excessive invalid NSEC records; and AdditionalTrap, where the default DNSSEC validation of the ADDITIONAL section is used to waste resources.

Recommendations Update to a version newer than 1.26.0.