The CVE number for this vulnerability is CVE-2026-80225.


== Summary
A degradation of service vulnerability is present in Unbound's TCP/DoT reading
procedure where there is no limit on consecutive reads.
A malicious actor that can stream and sustain a rate of distinct uncached names
over the TCP/DoT connection, monopolizes a single worker's entire event loop
for as long as its writes stay ahead of the drain.

Unbound 1.26.1 includes a fix to limit consecutive reads from a single TCP/DoT
connection, similar to its UDP logic.


== Affected products
Unbound up to and including version 1.26.0.


== Mitigation

=== Downloading patched version
Unbound 1.26.1 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz

=== Applying the patch manually
For Unbound 1.26.0 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-80225_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-80225_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-80225.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.26.0.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.