The CVE number for this vulnerability is CVE-2026-96405.

A multi-vendor DNS decompression vulnerability has been discovered in DNS
software.

Unbound is vulnerable when decompressing upstream replies and zone transfer
packets.


== Description
Unbound limits compression-pointer traversal for each individual domain-name
operation but has no aggregate inbound decompression-work budget.
Many chained compression pointers in a message results in a lot of CPU usage
following them.

A malicious actor with recursive-query access and control of an ordinarily
delegated authority that serves specially crafted replies can exploit the
vulnerability and degrade Unbound's general performance.

Unbound 1.26.2 includes a fix to introduce an aggregate decompression limit of
2048 per upstream reply packet and an aggregate decompression limit of 128000
per zone transfer packets.


== Affected products
Unbound up to and including version 1.26.1.


== Mitigation

=== Downloading patched version
Unbound 1.26.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.2.tar.gz

=== Applying the patch manually
For Unbound 1.26.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-96405_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-96405_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-96405.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.26.1.


== Acknowledgments
We would like to thank Yuheng Zhang from Tsinghua University and Jingxian
Technology Co., Ltd., Jianjun Chen from Tsinghua University, Zihan Wang from
Z.AI Co., Ltd. and Kaiwen Shen from CloudItera for discovering and responsibly
disclosing the vulnerability.