CVE-2026-85501 is a medium severity denial of service weakness in NLnet Labs Unbound up to and including 1.26.0. Malicious DNSSEC zones can make a resolver spend excessive effort on validation. Unbound 1.26.1 adds limits that stop this. Upgrade, or apply the NLnet Labs patch to 1.26.0.
What's affected
- Product: NLnet Labs Unbound, the validating DNS resolver.
- Affected: up to and including 1.26.0.
- Fixed: 1.26.1, which includes the limits described below.
- Patch route: NLnet Labs publishes patches for 1.26.0, a fuller one and a minimal one, tested against that version. Distribution packages may carry the fix under their own version numbers, so check your vendor's advisory.
Severity in the record: Medium, CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Weakness class: CWE-770 (Allocation of Resources Without Limits or Throttling).
How to check if you're exposed
- Print the version with
unbound -V. The output starts with the version number. - If you install from a Linux distribution, check the distribution's security tracker for CVE-2026-85501 rather than relying only on the upstream version, since packages often backport fixes.
- Check whether your resolver validates DNSSEC at all. Validation is what the attack exercises.
- Watch CPU on resolvers. A sudden jump while queries for unfamiliar zones rise is the symptom described: degraded service.
What to do now
- Upgrade to Unbound 1.26.1 or later, or install your distribution's fixed package.
- If you build from source and cannot upgrade yet, apply the NLnet Labs patch for 1.26.0, then run the install step.
- After the upgrade, confirm the new defaults. The advisory says
val-clean-additionalnow defaults to off. - Know the new limits and their settings:
val-hash-attemptsandval-validation-attemptscap delegation work. Do not raise them without a reason. - Add alerts for resolver CPU and query latency so you notice slow downs early.
Why it matters
The ReTrap research describes algorithmic complexity attacks: inputs that look small but make the validator do a lot of work. The NLnet advisory lists four that apply to Unbound. TagTrap abuses key tag matching with many mismatched keys and signatures. DelegationTrap makes the chain of trust expensive for deeply nested names. NsecTrap sends many invalid NSEC records. AdditionalTrap makes the resolver validate the additional section by default. The class is CWE-770, allocation of resources without limits.
The fix is limits. Unbound caps DNSKEY tag matches at 256, DS and DNSKEY attempts at 32 each, and NSEC or NSEC3 validations at 8 per message. The impact is reduced service, not data loss, which fits the Medium rating. Resolvers sit under everything else, though, so slowness spreads. The record does not mark this CVE as exploited in the wild.
Try it yourself
Continuous monitoring is how you learn a new advisory touches software you already run. This demo shows the idea.
Click through it at your own pace, or open it full screen.
Quick check
What changed in Unbound 1.26.1?
It adds limits on key tag matches, DS and DNSKEY validation attempts and NSEC validations, and turns off validation of the additional section by default.
Sources
Last reviewed: 18 October 2026.
