CVE-2026-80225

Vendor solution

This issue is fixed starting with version 1.26.1

Red Hat statement

This Moderate severity flaw in Unbound allows a remote attacker to cause a denial of service by continuously sending distinct, uncached DNS queries over a TCP or DNS-over-TLS (DoT) connection. This can monopolize a single worker's event loop, leading to service degradation for legitimate users. The impact is limited to availability and requires sustained malicious traffic.

Red Hat mitigation

To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_NETWORK>" port port="53" protocol="tcp" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_NETWORK>" port port="853" protocol="tcp" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections.