Threat Intelligence Database

NLnet Labs Unbound versions up to and including 1.25.0 contain a vulnerability in handling DNS replies with very large resource record sets (RRsets) requiring name compression. Maliciously crafted upstream DNS responses with large RRsets that lack shared suffixes above the root cause Unbound to spend excessive CPU time applying name compression, leading to degraded performance and potential denial of service. The issue arises because the compression counter is not incremented in certain code paths, allowing unbounded processing. This vulnerability is addressed in Unbound version 1.25.1, which includes a patch to increment the compression counter regardless of compression tree lookup success. Red Hat has released security advisories providing updated packages that fix this vulnerability for their hardened images and Red Hat Enterprise Linux 10 distributions.

NLnet Labs Unbound up to and including version 1.25.0 contains a vulnerability in its jostle logic that can degrade DNS resolution performance. The flaw allows retransmitted duplicate queries to reset the aging timer of slow queries, preventing their replacement and potentially causing denial of resolution service under coordinated attack. Cache and local data responses are not affected. Unbound 1.25.1 includes a patch that fixes this by attaching a fixed start time to queries, enabling proper aging and replacement logic.