CVE-2026-42923

A flaw was found in Unbound's DNSSEC validator where the code path for consulting the negative cache for DS records does not honor the limit on NSEC3 hash calculations introduced in version 1.19.1. An adversary who controls a DNSSEC-signed zone can sign NSEC3 records with high iteration counts for child delegations, causing Unbound to perform excessive hash computations while holding a global lock on the negative cache. This temporarily blocks other resolver threads from accessing the negative cache, leading to degraded DNS resolution performance for the duration of the attack.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate. The flaw can be remotely triggered without authentication, but the impact is limited to service degradation rather than a full denial-of-service.The Unbound process does not crash,a global negative cache lock is held during excessive NSEC3 hash computations, temporarily blocking other resolver threads. The root cause is a negative cache code path that bypasses the existing NSEC3 hash computation limits.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.