CVE-2026-96405

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.2

Description NLnet Labs Unbound limits compression-pointer traversal for each individual domain-name operation but lacks an aggregate inbound decompression-work budget. A malicious actor with recursive-query access and control of a delegated authority can send specially crafted replies containing many chained compression pointers. This causes excessive CPU usage while following the pointers, leading to a degradation of general performance.

Recommendations Update to a version newer than 1.26.1.