CyberRota Analysis
AI-GeneratedUnbound versions up to 1.26.0 are vulnerable to algorithmic complexity attacks on DNSSEC, specifically through mechanisms such as TagTrap, DelegationTrap, and NsecTrap, which can lead to service degradation when handling malicious DNS responses. These vulnerabilities allow attackers to exploit the resolver's resource validation processes, potentially overwhelming it with excessive computational demands. Organizations utilizing Unbound for DNS resolution should prioritize patching to mitigate the risk of service disruption from these attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.
Related CVEs
Other vulnerabilities affecting the same vendor(s)