Live › vulnerability › CVE-2026-96405
Go to dashboardUnbound up to and including 1.26.1 limits compression-pointer traversal per domain-name operation but has no aggregate decompression budget per inbound message. A crafted reply with many chained compression pointers makes Unbound spend heavy CPU, degrading its performance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Operators running Unbound 1.26.1 or earlier as a recursive resolver that serves clients. The attack needs a client able to send recursive queries and a delegated authority that returns specially crafted replies, so resolvers limited to trusted networks have much less exposure. Authoritative-only deployments are not described as affected.
No product ranges from the sources yet.
unbound -V and compare the reported version against 1.26.1.1.26.1 once a patched release is available; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.
This page as .md · .json · in your agent: get_signal("CVE-2026-96405")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.