Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-96405— Aggregate DNS name chained pointer decompression work leads to degradation of service.

Quick assessment

Affected
NLnet Labs Unbound
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NLnet Labs 开发的 Unbound 软件（版本 1.26.1 及之前）虽然对每个独立的域名操作限制了压缩指针的遍历，但并未设置针对整体入站解压缩工作的预算上限。当数据包中包含大量链式压缩指针时，追踪这些指针会消耗大量 CPU 资源。拥有递归查询权限并能够控制通常被委派权威域名服务器的恶意攻击者，可以通过发送精心构造的响应来利用该漏洞，从而降低 Unbound 的整体性能。

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-96405

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Aggregate DNS name chained pointer decompression work leads to degradation of service.
Source: CVE Program / CVE List V5
Vulnerability Description
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
NLnet Labs Unbound 0 ~ 1.26.2 -

II. Public POCs for CVE-2026-96405

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-96405

请登录查看更多情报信息。

Other References for CVE-2026-96405 (1)

Same Patch Batch · NLnet Labs · 2026-10-21 · 5 CVEs total

CVE-2026-97206 7.5 HIGH DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployment
CVE-2026-50106 6.5 MEDIUM Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor
CVE-2026-109125 5.3 MEDIUM Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply
CVE-2026-35501 3.7 LOW Bypass of a configured island trust anchor underneath an insecure parent from an atacker-c

IV. Related Vulnerabilities

Same product: Unbound
Same vendor: NLnet Labs
Same weakness: CWE-770

V. Comments for CVE-2026-96405

No comments yet

Leave a comment