NLnet Labs Unbound limits compression-pointer traversal for each individual domain-name operation but lacks an aggregate inbound decompression-work budget. A malicious actor with recursive-query access and control of a delegated authority can send specially crafted replies containing many chained compression pointers. This causes excessive CPU usage while following the pointers, leading to a degradation of general performance.