{"id":"CVE-2026-41292","title":"NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options","summary":"NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threa…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-407","CWE-770","CWE-1050"],"vendor":"nlnetlabs","product":"unbound","affected":["unbound < 1.25.1"],"patched":["unbound 1.25.1"],"published":"2026-05-20","updated":"2026-07-16","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41292","references":[{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt","label":"sep@nlnetlabs.nl"},{"url":"https://access.redhat.com/errata/RHSA-2026:24013","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-41292","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480125","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41292"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41292"},{"url":"https://access.redhat.com/errata/RHSA-2026:54769"},{"url":"https://access.redhat.com/errata/RHSA-2026:36320"},{"url":"https://access.redhat.com/errata/RHSA-2026:37282"},{"url":"https://access.redhat.com/errata/RHSA-2026:36777"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00748,"epssPercentile":0.5469,"ingestedAt":"2026-07-16T12:53:56.090Z","slug":"CVE-2026-41292","body":"## Overview\n\nNLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).\n\n## Affected\n\n- `unbound < 1.25.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `unbound 1.25.1`\n\n## Vendor advisories\n\n- **RHSA-2026:54769** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:54769)\n- **RHSA-2026:36320** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:36320)\n- **RHSA-2026:37282** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37282)\n- **RHSA-2026:36777** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36777)\n- **RHSA-2026:24013** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:24013)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 16.2, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}