The CVE number for this vulnerability is CVE-2026-85501.


== Summary
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have
been researched under the term 'ReTrap'.
These result in degradation of service when malicious zones are used to serve
the algorithmic complexity vulnerabilities.

The ones that are relevant to Unbound are:
- TagTrap:
  The triple(Zone, Algo, KeyTag) matching mechanism introduces a significant
  attack vector when resolvers handle malicious responses containing numerous
  mismatched DNSKEY, RRSIG, and DS record.
- DelegationTrap:
  Constructing the chain-of-trust requires iterative validation of DNSKEY
  and DS records from the root zone downward. For deeply nested domains, this
  results in significant computational overhead.
- NsecTrap:
  Responses with excessive invalid NSEC records compel the resolver to validate
  each one.
- AdditionalTrap:
  Unbound by default would try to DNSSEC validate the ADDITIONAL section as
  well. This can be exploited to waste validation resources by malicious users.

Unbound 1.26.1 includes fixes to limit/throttle resources in those cases.
Namely:
- TagTrap:
  Limit the number of DNSKEY tag matches (256).
  For matches from DNSKEY to RRSIG and DS to DNSKEY.
- DelegationTrap:
  Limit the number of attempted DS operations (32);
  limit the number of attempted DNSKEY operations (32).
  Configurable with 'val-hash-attempts' and 'val-validation-attempts'
  respectively.
- NsecTrap:
  Limit the number of NSEC or NSEC3 validations (8) per message.
  If exceeded there is no validator restart.
- AdditionalTrap:
  The config 'val-clean-additional' is changed to be off by default
  disabling DNSSEC validation of additional section RRsets.


== Affected products
Unbound up to and including version 1.26.0.


== Mitigation

=== Downloading patched version
Unbound 1.26.1 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz

=== Applying the patch manually
For Unbound 1.26.0 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-85501_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-85501_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-85501.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.26.0.


== Acknowledgments
We would like to thank Zuyao Xu and Xiang Li from Nankai University, AOSP Lab
for discovering and responsibly disclosing the vulnerability.
Additionally,Qifan Zhang from Palo Alto Networks for a complimentary report.