CVE-2026-42534

A flaw was found in Unbound. An adversary who can query a vulnerable Unbound instance and control a slow or malicious domain name server can exploit a vulnerability in the jostle logic. This flaw allows retransmitted queries to renew the age of slow-running queries, preventing them from being identified as aged and replaced. This can degrade Unbound's resolution performance, potentially leading to a denial of resolution service through coordinated attacks.

This flaw is rated as Important. An attacker controlling a malicious DNS server could exploit a vulnerability in Unbound's jostle logic, leading to degraded resolution performance and a potential denial of service. This occurs because retransmitted queries can incorrectly renew the age of slow-running queries, preventing their proper replacement.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate the risk of denial of resolution service, restrict Unbound's network exposure. Configure Unbound to only accept queries from trusted internal networks and to forward its own queries exclusively to trusted, well-maintained upstream DNS servers. This reduces the opportunity for an adversary to interact with or act as a malicious upstream for the vulnerable Unbound instance. After modifying Unbound's configuration, a service restart is required for changes to take effect. This may temporarily interrupt DNS resolution services.