Kaiwen Shen

NLnet Labs Unbound limits compression-pointer traversal for each individual domain-name operation but lacks an aggregate inbound decompression-work budget. A malicious actor with recursive-query access and control of a delegated authority can send specially crafted replies containing many chained compression pointers. This causes excessive CPU usage while following the pointers, leading to a degradation of general performance.

The issue allows for HTTP Request Smuggling, which can be exploited.

The issue is related to weak cipher suites being enabled by default. This could potentially lead to security risks.

The issue allows for HTTP request smuggling, which can be exploited. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.