GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80225 (GCVE-0-2026-80225)

Vulnerability from cvelistv5 – Published: 2026-09-16 08:30 – Updated: 2026-09-16 14:33
VLAI
Title
Possible degradation of service from continuous queries on the same TCP/DoT connection
Summary
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:32 UTC
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version CPE status
NLnet Labs Unbound Affected: 0 , < 1.26.1 (semver)
guessed Create a notification for this product.
Date Public
2026-09-16 00:00
Credits
Qifan Zhang (Palo Alto Networks)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80225",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:32:57.188145Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:33:08.344Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unbound",
          "vendor": "NLnet Labs",
          "versions": [
            {
              "lessThan": "1.26.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Qifan Zhang (Palo Alto Networks)"
        }
      ],
      "datePublic": "2026-09-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0027s entire event loop for as long as its writes stay ahead of the drain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T08:30:04.246Z",
        "orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
        "shortName": "NLnet Labs"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue is fixed starting with version 1.26.1"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-12T00:00:00.000Z",
          "value": "Issue reported by Qifan Zhang"
        },
        {
          "lang": "en",
          "time": "2026-09-01T00:00:00.000Z",
          "value": "NLnet Labs shares patch"
        },
        {
          "lang": "en",
          "time": "2026-09-16T00:00:00.000Z",
          "value": "Fixes released with version 1.26.1"
        }
      ],
      "title": "Possible degradation of service from continuous queries on the same TCP/DoT connection",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
    "assignerShortName": "NLnet Labs",
    "cveId": "CVE-2026-80225",
    "datePublished": "2026-09-16T08:30:04.246Z",
    "dateReserved": "2026-09-07T14:06:21.952Z",
    "dateUpdated": "2026-09-16T14:33:08.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80225",
      "date": "2026-09-17",
      "epss": "0.00312",
      "percentile": "0.2419"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:02:00.000Z",
      "cve": "CVE-2026-80225",
      "id": "msrc_CVE-2026-80225",
      "initial_release_date": "2026-09-17T01:02:00.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Possible degradation of service from continuous queries on the same TCP/DoT connection",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80225.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80225\",\"sourceIdentifier\":\"sep@nlnetlabs.nl\",\"published\":\"2026-09-16T09:17:06.100\",\"lastModified\":\"2026-09-16T19:41:10.423\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0027s entire event loop for as long as its writes stay ahead of the drain.\"}],\"affected\":[{\"source\":\"sep@nlnetlabs.nl\",\"affectedData\":[{\"vendor\":\"NLnet Labs\",\"product\":\"Unbound\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.26.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"sep@nlnetlabs.nl\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-16T14:32:57.188145Z\",\"id\":\"CVE-2026-80225\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"sep@nlnetlabs.nl\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt\",\"source\":\"sep@nlnetlabs.nl\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T20:51:30+00:00",
      "cve": "CVE-2026-80225",
      "id": "CVE-2026-80225",
      "initial_release_date": "2026-09-16T08:30:04.246000+00:00",
      "product_status:known_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-80225\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-16T14:32:57.188145Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-16T14:33:01.748Z\"}}], \"cna\": {\"title\": \"Possible degradation of service from continuous queries on the same TCP/DoT connection\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Qifan Zhang (Palo Alto Networks)\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"NLnet Labs\", \"product\": \"Unbound\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.26.1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-08-12T00:00:00.000Z\", \"value\": \"Issue reported by Qifan Zhang\"}, {\"lang\": \"en\", \"time\": \"2026-09-01T00:00:00.000Z\", \"value\": \"NLnet Labs shares patch\"}, {\"lang\": \"en\", \"time\": \"2026-09-16T00:00:00.000Z\", \"value\": \"Fixes released with version 1.26.1\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"This issue is fixed starting with version 1.26.1\"}], \"datePublic\": \"2026-09-16T00:00:00.000Z\", \"references\": [{\"url\": \"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0027s entire event loop for as long as its writes stay ahead of the drain.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770: Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"206fc3a0-e175-490b-9eaa-a5738056c9f6\", \"shortName\": \"NLnet Labs\", \"dateUpdated\": \"2026-09-16T08:30:04.246Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-80225\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-16T14:33:08.344Z\", \"dateReserved\": \"2026-09-07T14:06:21.952Z\", \"assignerOrgId\": \"206fc3a0-e175-490b-9eaa-a5738056c9f6\", \"datePublished\": \"2026-09-16T08:30:04.246Z\", \"assignerShortName\": \"NLnet Labs\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.