NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).
CVSS Details
- CVSS 4.0 Base Score: 6.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red)
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade unboundUpgrade python3-unboundUpgrade unbound-dracutUpgrade unbound-develUpgrade unbound-libs | Aug 2, 2026 | Jul 8, 2026 |
| Alpine Linux | — | Upgrade unbound | Jun 18, 2026 | May 20, 2026 |
| Amazon Linux Ami 2 | — | Upgrade unbound-libsUpgrade python3-unboundUpgrade unbound-utilsUpgrade unbound-develUpgrade python2-unboundUpgrade unbound-debuginfoUpgrade unboundUpgrade unbound-anchor | Jun 9, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-unbound-debuginfoUpgrade unbound-libs-debuginfoUpgrade unbound-anchor-debuginfoUpgrade unbound-debuginfoUpgrade unbound-anchorUpgrade unbound-utils-debuginfoUpgrade python3-unboundUpgrade unbound-utilsUpgrade unbound-develUpgrade unboundUpgrade unbound-debugsourceUpgrade unbound-libs | May 28, 2026 | May 20, 2026 |
| Debian | — | Upgrade unbound | Jul 23, 2026 | Jul 23, 2026 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jul 28, 2026 | Jul 27, 2026 |
| Freebsd | — | Upgrade FreeBSDUpgrade unbound | Jun 15, 2026 | Jun 10, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 19, 2026 | May 20, 2026 |
| Redhat_linux | — | Upgrade unbound-libsUpgrade unbound-libs-debuginfoUpgrade unboundUpgrade unbound-develUpgrade unbound-utilsUpgrade unbound-debugsourceUpgrade unbound-anchorUpgrade unbound-dracutUpgrade python3-unboundUpgrade unbound-debuginfoNo solution existsUpgrade unbound-anchor-debuginfoUpgrade python3-unbound-debuginfoUpgrade unbound-utils-debuginfo | Jul 17, 2026 | May 20, 2026 |
| Rocky_linux | — | Upgrade unbound-libsUpgrade python3-unboundUpgrade unbound-debugsourceUpgrade unboundUpgrade unbound-libs-debuginfoUpgrade python3-unbound-debuginfoUpgrade unbound-dracutUpgrade unbound-debuginfoUpgrade unbound-devel | Jul 30, 2026 | Jul 28, 2026 |
| Ubuntu | — | Upgrade unbound (Ubuntu Pro)Upgrade unboundUpgrade libunbound8 (Ubuntu Pro)Upgrade libunbound2 (Ubuntu Pro)Upgrade libunbound8 | May 25, 2026 | May 20, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 5, 2026 | May 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub