CVE-2026-41292: Long list of incoming EDNS options degrades performance

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-20 · updated 2026-08-26
Weakness: CWE-407

Description

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).

Affected products

NLnet Labs Unbound: before 1.25.1 — fixed in 1.25.1

How to fix

Upgrade to a fixed version: NLnet Labs Unbound 1.25.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41292 or the next vulnerability affects your stack