# CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service

CVE-2026-44390 is fixed in 15 products on 1 platform, first by libunbound8 1.24.2-1ubuntu2.1, released May 19, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-44390
- Priority: High
- CVSS: 7.5 (Low)
- EPSS: 0.0065
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 19, 2026
- Weakness: Inefficient Algorithmic Complexity
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44390

## Description

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suffix above the root can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for this but it didn't account for the case where records would not share any suffix above the root. That causes Unbound to go in a different code path because of the compression tree lookup failure and eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch with a fix that increments the compression counter regardless of the compression tree lookup. This is a complement fix to CVE-2024-8508.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libunbound8 Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.15 | [libunbound8 1.13.1-1ubuntu5.15](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libunbound8-1.13.1-1ubuntu5.15.md) | May 27, 2026 |
| Linux | libunbound8 Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.8 | [libunbound8 1.19.2-1ubuntu3.8](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libunbound8-1.19.2-1ubuntu3.8.md) | May 27, 2026 |
| Linux | libunbound8 Ubuntu 25.10 (questing) | 1.22.0-2ubuntu2.3 | [libunbound8 1.22.0-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libunbound8-1.22.0-2ubuntu2.3.md) | May 27, 2026 |
| Linux | libunbound8 Ubuntu 26.04.1 LTS (resolute) | 1.24.2-1ubuntu2.1 | [libunbound8 1.24.2-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libunbound8-1.24.2-1ubuntu2.1.md) | May 19, 2026 |
| Linux | python3-unbound RHEL 8 | 0:1.16.2-5.12.el8_10 | [RHSA-2026:37282](https://patchblox.com/security/data/fix/linux/rhsa-2026-37282.md) | Jul 31, 2026 |
| Linux | python3-unbound RHEL 9 | 0:1.24.2-3.el9_8.2 | [RHSA-2026:36777](https://patchblox.com/security/data/fix/linux/rhsa-2026-36777.md) | Jul 31, 2026 |
| Linux | python3-unbound Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.15 | [python3-unbound 1.13.1-1ubuntu5.15](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-unbound-1.13.1-1ubuntu5.15.md) | May 27, 2026 |
| Linux | python3-unbound Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.8 | [python3-unbound 1.19.2-1ubuntu3.8](https://patchblox.com/security/data/fix/linux/ubuntu-noble-python3-unbound-1.19.2-1ubuntu3.8.md) | May 27, 2026 |
| Linux | python3-unbound Ubuntu 25.10 (questing) | 1.22.0-2ubuntu2.3 | [python3-unbound 1.22.0-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-questing-python3-unbound-1.22.0-2ubuntu2.3.md) | May 27, 2026 |
| Linux | python3-unbound Ubuntu 26.04.1 LTS (resolute) | 1.24.2-1ubuntu2.1 | [python3-unbound 1.24.2-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-python3-unbound-1.24.2-1ubuntu2.1.md) | May 19, 2026 |
| Linux | python3-unbound almalinux 10 | 1.24.2-7.el10_2.2 | [ALSA-2026:36320](https://patchblox.com/security/data/fix/linux/alsa-2026-36320.md) | Jul 7, 2026 |
| Linux | python3-unbound almalinux 8 | 1.16.2-5.12.el8_10 | [ALSA-2026:37282](https://patchblox.com/security/data/fix/linux/alsa-2026-37282.md) | Jul 9, 2026 |
| Linux | python3-unbound almalinux 9 | 1.24.2-3.el9_8.2 | [ALSA-2026:36777](https://patchblox.com/security/data/fix/linux/alsa-2026-36777.md) | Jul 8, 2026 |
| Linux | python3-unbound amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |
| Linux | python3-unbound ol 10 | 0:1.24.2-7.el10_2.2 | [ELSA-2026-36320](https://patchblox.com/security/data/fix/linux/elsa-2026-36320.md) | Jul 16, 2026 |
| Linux | python3-unbound ol 8 | 0:1.16.2-5.12.el8_10 | [ELSA-2026-37282](https://patchblox.com/security/data/fix/linux/elsa-2026-37282.md) | Jul 9, 2026 |
| Linux | python3-unbound ol 9 | 0:1.24.2-3.el9_8.2 | [ELSA-2026-36777](https://patchblox.com/security/data/fix/linux/elsa-2026-36777.md) | Jul 9, 2026 |
| Linux | python3-unbound-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |
| Linux | unbound Debian 13.5 (trixie) | 1.22.0-2+deb13u3 | [DEBIAN-CVE-2026-44390](https://patchblox.com/security/data/fix/linux/debian-cve-2026-44390.md) | May 27, 2026 |
| Linux | unbound Debian 14 | 1.25.1-1 | [DEBIAN-CVE-2026-44390](https://patchblox.com/security/data/fix/linux/debian-cve-2026-44390.md) | May 27, 2026 |
| Linux | unbound RHEL 10 | 1.24.2-7.el10_2.2 | [RHSA-2026:36320](https://patchblox.com/security/data/fix/linux/rhsa-2026-36320.md) | May 20, 2026 |
| Linux | unbound RHEL 8 | 0:1.16.2-5.12.el8_10 | [RHSA-2026:37282](https://patchblox.com/security/data/fix/linux/rhsa-2026-37282.md) | Jul 31, 2026 |
| Linux | unbound RHEL 9 | 0:1.24.2-3.el9_8.2 | [RHSA-2026:36777](https://patchblox.com/security/data/fix/linux/rhsa-2026-36777.md) | Jul 31, 2026 |
| Linux | unbound Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.15 | [unbound 1.13.1-1ubuntu5.15](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-unbound-1.13.1-1ubuntu5.15.md) | May 27, 2026 |
| Linux | unbound Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.8 | [unbound 1.19.2-1ubuntu3.8](https://patchblox.com/security/data/fix/linux/ubuntu-noble-unbound-1.19.2-1ubuntu3.8.md) | May 27, 2026 |
| Linux | unbound Ubuntu 25.10 (questing) | 1.22.0-2ubuntu2.3 | [unbound 1.22.0-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-questing-unbound-1.22.0-2ubuntu2.3.md) | May 27, 2026 |
| Linux | unbound Ubuntu 26.04.1 LTS (resolute) | 1.24.2-1ubuntu2.1 | [unbound 1.24.2-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-unbound-1.24.2-1ubuntu2.1.md) | May 19, 2026 |
| Linux | unbound almalinux 10 | 1.24.2-7.el10_2.2 | [ALSA-2026:36320](https://patchblox.com/security/data/fix/linux/alsa-2026-36320.md) | Jul 7, 2026 |
| Linux | unbound almalinux 8 | 1.16.2-5.12.el8_10 | [ALSA-2026:37282](https://patchblox.com/security/data/fix/linux/alsa-2026-37282.md) | Jul 9, 2026 |
| Linux | unbound almalinux 9 | 1.24.2-3.el9_8.2 | [ALSA-2026:36777](https://patchblox.com/security/data/fix/linux/alsa-2026-36777.md) | Jul 8, 2026 |
| Linux | unbound amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |
| Linux | unbound ol 10 | 0:1.24.2-7.el10_2.2 | [ELSA-2026-36320](https://patchblox.com/security/data/fix/linux/elsa-2026-36320.md) | Jul 16, 2026 |
| Linux | unbound ol 8 | 0:1.16.2-5.12.el8_10 | [ELSA-2026-37282](https://patchblox.com/security/data/fix/linux/elsa-2026-37282.md) | Jul 9, 2026 |
| Linux | unbound ol 9 | 0:1.24.2-3.el9_8.2 | [ELSA-2026-36777](https://patchblox.com/security/data/fix/linux/elsa-2026-36777.md) | Jul 9, 2026 |
| Linux | unbound opensuse-leap 16.0 | 1.24.1-160000.2.1 | [OPENSUSE-SU-2026:21083-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21083-1.md) | Jun 18, 2026 |
| Linux | unbound rocky 10 | 0:1.24.2-7.el10_2.2 | [RLSA-2026:36320](https://patchblox.com/security/data/fix/linux/rlsa-2026-36320.md) | Jul 28, 2026 |
| Linux | unbound rocky 8 | 0:1.16.2-5.12.el8_10 | [RLSA-2026:37282](https://patchblox.com/security/data/fix/linux/rlsa-2026-37282.md) | Jul 28, 2026 |
| Linux | unbound rocky 9 | 0:1.24.2-3.el9_8.2 | [RLSA-2026:36777](https://patchblox.com/security/data/fix/linux/rlsa-2026-36777.md) | Jul 28, 2026 |
| Linux | unbound sles 16.0 | 1.24.1-160000.2.1 | [SUSE-SU-2026:22160-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22160-1.md) | Jun 18, 2026 |
| Linux | unbound-anchor Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.15 | [unbound-anchor 1.13.1-1ubuntu5.15](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-unbound-anchor-1.13.1-1ubuntu5.15.md) | May 27, 2026 |
| Linux | unbound-anchor Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.8 | [unbound-anchor 1.19.2-1ubuntu3.8](https://patchblox.com/security/data/fix/linux/ubuntu-noble-unbound-anchor-1.19.2-1ubuntu3.8.md) | May 27, 2026 |
| Linux | unbound-anchor Ubuntu 25.10 (questing) | 1.22.0-2ubuntu2.3 | [unbound-anchor 1.22.0-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-questing-unbound-anchor-1.22.0-2ubuntu2.3.md) | May 27, 2026 |
| Linux | unbound-anchor Ubuntu 26.04.1 LTS (resolute) | 1.24.2-1ubuntu2.1 | [unbound-anchor 1.24.2-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-unbound-anchor-1.24.2-1ubuntu2.1.md) | May 19, 2026 |
| Linux | unbound-anchor almalinux 10 | 1.24.2-7.el10_2.2 | [ALSA-2026:36320](https://patchblox.com/security/data/fix/linux/alsa-2026-36320.md) | Jul 7, 2026 |
| Linux | unbound-anchor amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |
| Linux | unbound-anchor ol 10 | 0:1.24.2-7.el10_2.2 | [ELSA-2026-36320](https://patchblox.com/security/data/fix/linux/elsa-2026-36320.md) | Jul 16, 2026 |
| Linux | unbound-anchor-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |
| Linux | unbound-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |
| Linux | unbound-debugsource amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |
| Linux | unbound-devel RHEL 8 | 0:1.16.2-5.12.el8_10 | [RHSA-2026:37282](https://patchblox.com/security/data/fix/linux/rhsa-2026-37282.md) | Jul 31, 2026 |
| Linux | unbound-devel RHEL 9 | 0:1.24.2-3.el9_8.2 | [RHSA-2026:36777](https://patchblox.com/security/data/fix/linux/rhsa-2026-36777.md) | Jul 31, 2026 |
| Linux | unbound-devel almalinux 10 | 1.24.2-7.el10_2.2 | [ALSA-2026:36320](https://patchblox.com/security/data/fix/linux/alsa-2026-36320.md) | Jul 7, 2026 |
| Linux | unbound-devel almalinux 8 | 1.16.2-5.12.el8_10 | [ALSA-2026:37282](https://patchblox.com/security/data/fix/linux/alsa-2026-37282.md) | Jul 9, 2026 |
| Linux | unbound-devel almalinux 9 | 1.24.2-3.el9_8.2 | [ALSA-2026:36777](https://patchblox.com/security/data/fix/linux/alsa-2026-36777.md) | Jul 8, 2026 |
| Linux | unbound-devel amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |
| Linux | unbound-devel ol 10 | 0:1.24.2-7.el10_2.2 | [ELSA-2026-36320](https://patchblox.com/security/data/fix/linux/elsa-2026-36320.md) | Jul 16, 2026 |
| Linux | unbound-devel ol 8 | 0:1.16.2-5.12.el8_10 | [ELSA-2026-37282](https://patchblox.com/security/data/fix/linux/elsa-2026-37282.md) | Jul 9, 2026 |
| Linux | unbound-devel ol 9 | 0:1.24.2-3.el9_8.2 | [ELSA-2026-36777](https://patchblox.com/security/data/fix/linux/elsa-2026-36777.md) | Jul 9, 2026 |
| Linux | unbound-dracut RHEL 9 | 0:1.24.2-3.el9_8.2 | [RHSA-2026:36777](https://patchblox.com/security/data/fix/linux/rhsa-2026-36777.md) | Jul 31, 2026 |
| Linux | unbound-dracut almalinux 10 | 1.24.2-7.el10_2.2 | [ALSA-2026:36320](https://patchblox.com/security/data/fix/linux/alsa-2026-36320.md) | Jul 7, 2026 |
| Linux | unbound-dracut almalinux 9 | 1.24.2-3.el9_8.2 | [ALSA-2026:36777](https://patchblox.com/security/data/fix/linux/alsa-2026-36777.md) | Jul 8, 2026 |
| Linux | unbound-dracut ol 10 | 0:1.24.2-7.el10_2.2 | [ELSA-2026-36320](https://patchblox.com/security/data/fix/linux/elsa-2026-36320.md) | Jul 16, 2026 |
| Linux | unbound-dracut ol 9 | 0:1.24.2-3.el9_8.2 | [ELSA-2026-36777](https://patchblox.com/security/data/fix/linux/elsa-2026-36777.md) | Jul 9, 2026 |
| Linux | unbound-host Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.15 | [unbound-host 1.13.1-1ubuntu5.15](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-unbound-host-1.13.1-1ubuntu5.15.md) | May 27, 2026 |
| Linux | unbound-host Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.8 | [unbound-host 1.19.2-1ubuntu3.8](https://patchblox.com/security/data/fix/linux/ubuntu-noble-unbound-host-1.19.2-1ubuntu3.8.md) | May 27, 2026 |
| Linux | unbound-host Ubuntu 25.10 (questing) | 1.22.0-2ubuntu2.3 | [unbound-host 1.22.0-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-questing-unbound-host-1.22.0-2ubuntu2.3.md) | May 27, 2026 |
| Linux | unbound-host Ubuntu 26.04.1 LTS (resolute) | 1.24.2-1ubuntu2.1 | [unbound-host 1.24.2-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-unbound-host-1.24.2-1ubuntu2.1.md) | May 19, 2026 |
| Linux | unbound-libs RHEL 8 | 0:1.16.2-5.12.el8_10 | [RHSA-2026:37282](https://patchblox.com/security/data/fix/linux/rhsa-2026-37282.md) | Jul 31, 2026 |
| Linux | unbound-libs RHEL 9 | 0:1.24.2-3.el9_8.2 | [RHSA-2026:36777](https://patchblox.com/security/data/fix/linux/rhsa-2026-36777.md) | Jul 31, 2026 |
| Linux | unbound-libs almalinux 10 | 1.24.2-7.el10_2.2 | [ALSA-2026:36320](https://patchblox.com/security/data/fix/linux/alsa-2026-36320.md) | Jul 7, 2026 |
| Linux | unbound-libs almalinux 8 | 1.16.2-5.12.el8_10 | [ALSA-2026:37282](https://patchblox.com/security/data/fix/linux/alsa-2026-37282.md) | Jul 9, 2026 |
| Linux | unbound-libs almalinux 9 | 1.24.2-3.el9_8.2 | [ALSA-2026:36777](https://patchblox.com/security/data/fix/linux/alsa-2026-36777.md) | Jul 8, 2026 |
| Linux | unbound-libs amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |
| Linux | unbound-libs ol 10 | 0:1.24.2-7.el10_2.2 | [ELSA-2026-36320](https://patchblox.com/security/data/fix/linux/elsa-2026-36320.md) | Jul 16, 2026 |
| Linux | unbound-libs ol 8 | 0:1.16.2-5.12.el8_10 | [ELSA-2026-37282](https://patchblox.com/security/data/fix/linux/elsa-2026-37282.md) | Jul 9, 2026 |
| Linux | unbound-libs ol 9 | 0:1.24.2-3.el9_8.2 | [ELSA-2026-36777](https://patchblox.com/security/data/fix/linux/elsa-2026-36777.md) | Jul 9, 2026 |
| Linux | unbound-libs-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |
| Linux | unbound-utils almalinux 10 | 1.24.2-7.el10_2.2 | [ALSA-2026:36320](https://patchblox.com/security/data/fix/linux/alsa-2026-36320.md) | Jul 7, 2026 |
| Linux | unbound-utils amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |
| Linux | unbound-utils ol 10 | 0:1.24.2-7.el10_2.2 | [ELSA-2026-36320](https://patchblox.com/security/data/fix/linux/elsa-2026-36320.md) | Jul 16, 2026 |
| Linux | unbound-utils-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.12 | [ALAS2023-2026-1756](https://patchblox.com/security/data/fix/linux/alas2023-2026-1756.md) | May 25, 2026 |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.