CVE-2026-85501

A flaw was found in Unbound. This vulnerability, termed 'ReTrap', allows a remote attacker to launch algorithmic complexity attacks on the Domain Name System Security Extensions (DNSSEC) validation process. By serving malicious zones or responses, an attacker can exploit various mechanisms, such as mismatched DNSKEY records, deeply nested domains, or excessive invalid NSEC records. Successful exploitation leads to a degradation of service, effectively causing a Denial of Service (DoS) for affected Unbound resolvers.

This Moderate flaw in Unbound can lead to a denial of service due to algorithmic complexity attacks on DNSSEC. An attacker can exploit this by serving malicious DNS zones, causing Unbound to consume excessive resources during DNSSEC validation, thereby degrading service availability. This affects Red Hat products utilizing Unbound for DNSSEC resolution, where the default configuration validates the additional section of DNS responses.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate implement hard caps on iterative processing loops and resource allocations per request. Apply rate limiting and set strict connection/processing timeouts to prevent a single complex operation from tying up worker threads. For this specific flaw, administrators can also configure system-level resource constraints (like CPU cgroups) for the service.