CVE-2026-80225

A flaw was found in Unbound. A malicious actor can exploit a vulnerability in the TCP/DoT reading procedure, which lacks a limit on consecutive reads. By continuously streaming distinct uncached names over a TCP/DoT connection, an attacker can monopolize a worker's event loop. This can lead to a degradation of service, effectively causing a Denial of Service (DoS) for legitimate users.

This Moderate severity flaw in Unbound allows a remote attacker to cause a denial of service by continuously sending distinct, uncached DNS queries over a TCP or DNS-over-TLS (DoT) connection. This can monopolize a single worker's event loop, leading to service degradation for legitimate users. The impact is limited to availability and requires sustained malicious traffic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_NETWORK>" port port="53" protocol="tcp" accept' and firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_NETWORK>" port port="853" protocol="tcp" accept'. After adding rules, apply them with firewall-cmd --reload. Replace <TRUSTED_NETWORK> with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections.