The CVE number for this vulnerability is CVE-2026-42534.


== Summary
A vulnerability was found in Unbound's jostle logic that could defeat its
purpose and degrade resolution performance.
Retransmits of the same query could renew the age of slow running queries and
not allow the jostle logic to see them as aged and potential targets for
replacement with new queries.

Unbound 1.25.1 includes a fix to attach an initial, non-updatable start time
for incoming queries that allow the jostle logic to work as intended.


== Affected products
Unbound up to and including version 1.25.0.


== Description
An adversary who can query a vulnerable Unbound and who can control a domain
name server that replies slowly and/or maliciously to Unbound's queries can
exploit the vulnerability and degrade the resolution performance of Unbound.

When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic
kicks in.
When a new query comes in, half of the available queries that are also slow to
resolve are candidates for replacement.
The vulnerability then happens because duplicate queries that need resolution
would skew the aging result by using the timestamp of the latest duplicate
query instead of the original one that started the resolution effort.

Cache and local data response performance remains unaffected.

Coordinated attacks could raise this to a denial of resolution service.

Unbound 1.25.1 includes a fix to attach an initial, non-updatable start time
for incoming queries that allow the jostle logic to work as intended.


== Mitigation

=== Downloading patched version
Unbound 1.25.1 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.1.tar.gz

=== Applying the patch manually
For Unbound 1.25.0 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-42534.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-42534.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.0.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.