NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).
CVSS Details
- CVSS 4.0 Base Score: 6.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red)
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade unboundUpgrade unbound-dracutUpgrade unbound-libsUpgrade python3-unboundUpgrade unbound-devel | Aug 2, 2026 | Jul 8, 2026 |
| Alpine Linux | — | Upgrade unbound | Jun 18, 2026 | May 20, 2026 |
| Amazon Linux Ami 2 | — | Upgrade unbound-debuginfoUpgrade unbound-anchorUpgrade unboundUpgrade unbound-develUpgrade python3-unboundUpgrade python2-unboundUpgrade unbound-libsUpgrade unbound-utils | Jun 9, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade unboundUpgrade unbound-utils-debuginfoUpgrade unbound-anchorUpgrade unbound-develUpgrade unbound-debugsourceUpgrade unbound-utilsUpgrade python3-unboundUpgrade unbound-libsUpgrade unbound-libs-debuginfoUpgrade unbound-debuginfoUpgrade unbound-anchor-debuginfoUpgrade python3-unbound-debuginfo | May 28, 2026 | May 20, 2026 |
| Debian | — | Upgrade unbound | Jul 23, 2026 | Jul 23, 2026 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jul 28, 2026 | Jul 27, 2026 |
| Freebsd | — | Upgrade unboundUpgrade FreeBSD | Jun 15, 2026 | Jun 10, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 19, 2026 | May 20, 2026 |
| Redhat_linux | — | Upgrade unbound-libsUpgrade python3-unboundUpgrade unbound-utilsUpgrade unbound-libs-debuginfoUpgrade unboundUpgrade unbound-anchorUpgrade unbound-dracutUpgrade unbound-debugsourceUpgrade unbound-develUpgrade unbound-anchor-debuginfoUpgrade unbound-debuginfoUpgrade unbound-utils-debuginfoUpgrade python3-unbound-debuginfoNo solution exists | Jul 17, 2026 | May 20, 2026 |
| Rocky_linux | — | Upgrade python3-unboundUpgrade unbound-libsUpgrade unbound-debugsourceUpgrade unboundUpgrade unbound-debuginfoUpgrade unbound-dracutUpgrade unbound-develUpgrade python3-unbound-debuginfoUpgrade unbound-libs-debuginfo | Jul 30, 2026 | Jul 28, 2026 |
| Ubuntu | — | Upgrade libunbound8 (Ubuntu Pro)Upgrade libunbound2 (Ubuntu Pro)Upgrade libunbound8Upgrade unbound (Ubuntu Pro)Upgrade unbound | May 25, 2026 | May 20, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 5, 2026 | May 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub