---
id: "CVE-2026-96405"
kind: "vulnerability"
aliases: ["CVE-2026-96405"]
title: "Unbound DNS resolver: crafted replies can exhaust CPU during name decompression"
severity: "medium"
cvss: 5.3
epss: 0.00238
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns", "package", "self-hosted", "unbound"]
not_affected_if: ["auth-required", "authoritative-only"]
published_at: "2026-10-21T09:17:08+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:21:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96405", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96405", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Unbound DNS resolver: crafted replies can exhaust CPU during name decompression

Unbound up to and including 1.26.1 limits compression-pointer traversal per domain-name operation but has no aggregate decompression budget per inbound message. A crafted reply with many chained compression pointers makes Unbound spend heavy CPU, degrading its performance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `unbound -V` and compare the reported version against `1.26.1`.
- Check whether recursive queries are reachable from untrusted clients, since the attack needs recursive-query access.

## Fix

- Move Unbound to a version later than `1.26.1` once a patched release is available; the sources do not name the fixed version.
- Restrict recursive query access to trusted clients as an interim measure.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96405
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96405

## From the sources

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_