CVE-2026-44390

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.25.1

Description An issue exists when handling replies with very large RRsets (Resource Record sets) that require name compression. Malicious upstream responses containing very large RRsets with records that do not share a suffix above the root can cause the system to spend excessive time applying name compression to downstream replies. This can lead to degraded performance and denial of service. An adversary can trigger this by querying for specially crafted contents of a malicious zone. The process involves an unbounded operation that can lock the CPU until the packet is complete because the compression counter is not incremented when a compression tree lookup fails.

Recommendations Update to version 1.25.1.