NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform… (CVE-2026-44390)
NLnet Labs Unbound versions up to and including 1.25.0 contain a vulnerability in handling DNS replies with very large resource record sets (RRsets) requiring name compression. Maliciously crafted upstream DNS responses with large RRsets that lack shared suffixes above the root cause Unbound to spend excessive CPU time applying name compression, leading to degraded performance and potential denial of service. The issue arises because the compression counter is not incremented in certain code paths, allowing unbounded processing. This vulnerability is addressed in Unbound version 1.25.1, which includes a patch to increment the compression counter regardless of compression tree lookup success. Red Hat has released security advisories providing updated packages that fix this vulnerability for their hardened images and Red Hat Enterprise Linux 10 distributions.
AI Analysis
Technical Summary
The vulnerability in NLnet Labs Unbound up to 1.25.0 involves unbounded CPU consumption during name compression of DNS replies with very large RRsets that do not share suffixes above the root. When Unbound processes such maliciously crafted DNS responses, it enters a code path where the compression counter is not incremented due to compression tree lookup failures, causing excessive CPU usage and potential denial of service. This issue complements a previous fix (CVE-2024-8508) and was resolved in Unbound 1.25.1 by ensuring the compression counter increments regardless of lookup results. Red Hat advisories RHSA-2026:24013 and RHSA-2026:36320 confirm the availability of patched packages for their hardened images and RHEL 10, mitigating this vulnerability.
Potential Impact
An attacker can exploit this vulnerability by sending specially crafted DNS responses with very large RRsets to a vulnerable Unbound resolver, causing it to consume excessive CPU resources during name compression. This leads to degraded resolver performance and can result in denial of service conditions. There are no known exploits in the wild at this time. The vulnerability affects the availability of the DNS resolver service.
Mitigation Recommendations
A fix is available in Unbound version 1.25.1, which addresses the vulnerability by properly incrementing the compression counter in all code paths. Users should upgrade to Unbound 1.25.1 or later. Red Hat has released updated packages for their hardened images and Red Hat Enterprise Linux 10 distributions that include this fix. Applying these vendor-provided updates is the recommended remediation. Patch status is confirmed by Red Hat advisories RHSA-2026:24013 and RHSA-2026:36320.
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform… (CVE-2026-44390)
Description
NLnet Labs Unbound versions up to and including 1.25.0 contain a vulnerability in handling DNS replies with very large resource record sets (RRsets) requiring name compression. Maliciously crafted upstream DNS responses with large RRsets that lack shared suffixes above the root cause Unbound to spend excessive CPU time applying name compression, leading to degraded performance and potential denial of service. The issue arises because the compression counter is not incremented in certain code paths, allowing unbounded processing. This vulnerability is addressed in Unbound version 1.25.1, which includes a patch to increment the compression counter regardless of compression tree lookup success. Red Hat has released security advisories providing updated packages that fix this vulnerability for their hardened images and Red Hat Enterprise Linux 10 distributions.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in NLnet Labs Unbound up to 1.25.0 involves unbounded CPU consumption during name compression of DNS replies with very large RRsets that do not share suffixes above the root. When Unbound processes such maliciously crafted DNS responses, it enters a code path where the compression counter is not incremented due to compression tree lookup failures, causing excessive CPU usage and potential denial of service. This issue complements a previous fix (CVE-2024-8508) and was resolved in Unbound 1.25.1 by ensuring the compression counter increments regardless of lookup results. Red Hat advisories RHSA-2026:24013 and RHSA-2026:36320 confirm the availability of patched packages for their hardened images and RHEL 10, mitigating this vulnerability.
Potential Impact
An attacker can exploit this vulnerability by sending specially crafted DNS responses with very large RRsets to a vulnerable Unbound resolver, causing it to consume excessive CPU resources during name compression. This leads to degraded resolver performance and can result in denial of service conditions. There are no known exploits in the wild at this time. The vulnerability affects the availability of the DNS resolver service.
Mitigation Recommendations
A fix is available in Unbound version 1.25.1, which addresses the vulnerability by properly incrementing the compression counter in all code paths. Users should upgrade to Unbound 1.25.1 or later. Red Hat has released updated packages for their hardened images and Red Hat Enterprise Linux 10 distributions that include this fix. Applying these vendor-provided updates is the recommended remediation. Patch status is confirmed by Red Hat advisories RHSA-2026:24013 and RHSA-2026:36320.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6522-r5fq-99gw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-44390"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a6ae5599c2644c7f89a9643
Added to database: 07/30/2026, 05:47:05 UTC
Last enriched: 07/30/2026, 07:27:52 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.