CVE-2026-44390 describes an inefficient algorithmic complexity vulnerability in NLnet Labs Unbound DNS resolver up to version 1.25.0. When processing replies containing very large RRsets with records lacking a shared suffix above the root, Unbound's name compression mechanism can enter an unbounded operation, consuming excessive CPU resources and causing degraded performance or denial of service. Although a compression limit was introduced in version 1.21.1, it did not handle cases where compression tree lookups failed due to lack of shared suffixes, leading to the compression counter not being incremented and the operation continuing unchecked. Version 1.25.1 patches this by ensuring the compression counter increments regardless of lookup success, mitigating the vulnerability. This fix complements a related vulnerability CVE-2024-8508.

An attacker can exploit this vulnerability by sending specially crafted DNS responses with very large RRsets to an Unbound resolver, causing it to spend excessive CPU time on name compression. This can degrade resolver performance and potentially lead to denial of service conditions. The vulnerability affects Unbound versions up to and including 1.25.0. There are no known exploits in the wild at this time.

A patch addressing this vulnerability is available in Unbound version 1.25.1. Users should upgrade to version 1.25.1 or later to remediate this issue. Red Hat has released updated packages including unbound-1.25.1-2.hum1 for their Hardened Images and Enterprise Linux 10 distributions. Applying these vendor-provided updates will mitigate the vulnerability. No additional mitigation steps are indicated by the vendor advisories.