CVE-2026-80225

7.5 Élevée

Publiée le 16/09/2026 à 11:17 · Modifiée le 23/09/2026 à 21:57 · Analysée par le NVD · Source : sep@nlnetlabs.nl

Description

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.

Traduire en français

Produits concernés

NLnet Labs Unbound
Nlnetlabs unbound

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	sep@nlnetlabs.nl	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`
3.1	7.5 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-770

Références

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt PatchVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories