Back
CVE-2026-41292
Long list of incoming EDNS options degrades performance
Medium6.6EPSS 0.75%
- Published
- Updated
- Reserved
- Assigned by
- NLnet Labs
Description
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NLnet LabsCNA (assigner) | 4.0 | Medium6.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Red |
| redhat-SADPADP (enrichment) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 4.0 | Medium6.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red |
- EPSS (exploitation in 30 days)
- 0.75% · top 45% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.6.
Weakness
- CWE-407: Inefficient Algorithmic Complexity (opens in a new tab)All about CWE-407 and its CVEs
- CWE-770: Allocation of Resources Without Limits or Throttling (opens in a new tab)All about CWE-770 and its CVEs
- CWE-1050: Excessive Platform Resource Consumption within a Loop (opens in a new tab)All about CWE-1050 and its CVEs
Affected products
- affected < 1.25.1
What to do
Solution: This issue is fixed starting with version 1.25.1
References (9)
- https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt (opens in a new tab)vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-41292 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2480125 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json (opens in a new tab)x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:54769 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36320 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37282 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36777 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24013 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-41292)Record last updated .