Threat Intelligence Database

NLnet Labs Unbound versions up to and including 1.25.0 contain a vulnerability related to inefficient algorithmic complexity in handling DNS replies with very large resource record sets (RRsets). This flaw can cause Unbound to spend excessive time applying name compression, potentially leading to degraded performance or denial of service. The issue arises when records do not share a suffix above the root, causing an unbounded operation in name compression. A fix was introduced in version 1.25.1 that correctly increments the compression counter regardless of compression tree lookup results, addressing this vulnerability.

NLnet Labs Unbound versions up to and including 1.25.0 contain a vulnerability in the jostle logic that can degrade DNS resolution performance. This occurs because retransmitted duplicate queries renew the age of slow queries, preventing their replacement and causing performance degradation. An attacker controlling a slow or malicious authoritative DNS server can exploit this to degrade resolution performance or cause denial of resolution service. Cache and local data responses are unaffected. The issue is fixed in Unbound version 1.25.1, which attaches an immutable start time to queries to enable correct aging and replacement logic.

NLnet Labs Unbound versions up to and including 1.24.1 are vulnerable to domain hijack attacks via acceptance of unsolicited NS RRSets in DNS replies. Attackers can inject malicious NS RRSets to poison the resolver's delegation information. Version 1.24.1 introduced a fix that removes unsolicited NS RRSets from replies, and 1.24.2 further improves this by scrubbing such data from additional reply types.