CVE-2026-41292: nlnet labs unbound Inefficient Algorithmic Complexity

Vulnerability summary

CVE-2026-41292 is a high (CVSS 7.5) Inefficient Algorithmic Complexity vulnerability in nlnet labs unbound. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.9% of scored vulnerabilities.

Timeline

1. 20-05-2026
   PublishedVulnerability first disclosed.
2. 01-09-2026
   Last modifiedVulnerability information updated.

Description

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).

• CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
• CWE-1050Excessive Platform Resource Consumption within a LoopThe product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.