MEDIUM 5.3 NVD

CVE-2026-96405

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inboun

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-96405.txt

Published: 2026-10-21 · Source: NVD · Feed updated: 2026-10-21

This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-21 via NVD.

vulnfeed aggregates 18720 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.