CVE-2026-80225

🔶 medium

Summary

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.

CVSS Score

5.3

Medium

EPSS Score

0.5

Exploit Probability

Published Date

2026-09-16

First Seen: 2026-09-18

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 19.0% of all 365,968 vulnerabilities in our database.

#296,586

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Sep 16, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Qifan Zhang (Palo Alto Networks)

SSVC data provided by CISA

Last Modified 2026-09-23

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE IDs (Weakness Types)

CWE-770

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
nlnetlabs	unbound	Affected	< 1.26.1

🔗 References 1

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-...

Patch Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-77860	ℹ️ low	3.7	0.3	In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a dou...	2026-09-16
CVE-2026-77955	🔶 medium	4.4	0.2	In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) ...	2026-09-16
CVE-2026-78227	🔶 medium	6.5	0.3	NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC...	2026-09-16
CVE-2026-81634	⚠️ high	7.5	0.5	In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap b...	2026-09-16
CVE-2026-81642	⛔ critical	9.8	1.0	In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial ...	2026-09-16
CVE-2026-82717	⛔ critical	9.8	0.8	In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memor...	2026-09-16

These CVEs affect the same products