PatchTheCVECVE-2026-80225: In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/
CVE-2026-80225 is a medium-severity flaw (CVSS 5.3) affecting unbound. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 59%) |
| CISA exploited list | No |
| Weakness | CWE-770 |
| Published | 2026-09-16 |
| Last modified | 2026-09-23 |
Last updated 2026-09-23 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Official advisories
- Amazon Linux 2 ALAS: ALAS2UNBOUND-1.17-2026-011 (important): unbound 2026-09-28
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-80225?
unbound: upgrade to 1.26.1. Exact commands for each OS are on this page.
Is CVE-2026-80225 being exploited?
CVE-2026-80225 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-80225 affect?
CVE-2026-80225 affects unbound. Severity is medium (CVSS 5.3). In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distin
How urgent is CVE-2026-80225?
Priority 34/100. Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-40691 HIGH 7.5 UPGRADE In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encr
- CVE-2026-32665 HIGH 7.5 UPGRADE In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the f
- CVE-2026-55973 HIGH 7.5 UPGRADE In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Repo
- CVE-2026-50252 CRITICAL 9.3 UPGRADE In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve a
- CVE-2026-50045 MEDIUM 5.3 UPGRADE In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under