CVE-2026-80225 is a medium severity (CVSS 5.3) degradation of service flaw in NLnet Labs Unbound, versions up to and including 1.26.0. A client streaming distinct uncached names over TCP or DNS over TLS can monopolize a worker event loop. Upgrade to Unbound 1.26.1, or apply the vendor patch.
What's affected
- Unbound up to and including version 1.26.0.
- Fixed in Unbound 1.26.1, which limits consecutive reads from one TCP or DoT connection, similar to the existing UDP logic.
- NLnet Labs also publishes patches for 1.26.0 if you cannot upgrade, and a minimal patch that addresses only this issue.
Record severity: CVSS 5.3 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The weakness class is CWE-770, Allocation of Resources Without Limits or Throttling.
How to check if you're exposed
Run unbound -V to print the version. On Debian or Ubuntu use apt policy unbound, and on Red Hat family systems rpm -q unbound. Distribution packages may backport fixes, so compare against the distribution security tracker as well. If you serve TCP or DNS over TLS clients, you are in the exposed group.
What to do now
- Check the Unbound version on each resolver.
- Upgrade to 1.26.1 or install the distribution package that includes the fix.
- If you build from source and cannot upgrade, apply the NLnet Labs patch for 1.26.0 and rebuild.
- Limit which clients can connect over TCP and DoT to those you serve.
- Watch resolver latency and worker saturation after the change.
Why it matters
The cause is uncontrolled resource consumption (CWE-770). Unbound reads from a TCP or DoT connection in a loop, and a client that keeps writing ahead of the drain can hold one worker for as long as it wants. Other queries handled by that worker wait. The fix limits consecutive reads, which is the approach already used for UDP.
The impact is availability only, which explains the medium score. Open resolvers and shared recursive services are the likeliest to feel it. The record does not mark the CVE as exploited in the wild.
Quick check
Does this expose data?
No. The advisory describes degradation of service only.
Is the minimal patch enough?
NLnet Labs says it addresses only the vulnerability and may be used instead of the fuller patch.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
