libunbound8: NLnet Labs Unbound up to and including version 1.21.0 contains avulnerability when handling replies with very large R...

NLnet Labs Unbound up to and including version 1.21.0 contains avulnerability when handling replies with very large RRsets that it needs toperform name compression for. Malicious upstreams responses with very largeRRsets can cause Unbound to spend a considerable time applying namecompression to downstream replies. This can lead to degraded performanceand eventually denial of service in well orchestrated attacks. Thevulnerability can be exploited by a malicious actor querying Unbound forthe specially crafted contents of a malicious zone with very large RRsets.Before Unbound replies to the query it will try to apply name compressionwhich was an unbounded operation that could lock the CPU until the wholepacket was complete. Unbound version 1.21.1 introduces a hard limit on thenumber of name compression calculations it is willing to do per packet.Packets that need more compression will result in semi-compressed packetsor truncated packets, even on TCP for huge messages, to avoid locking theCPU for long. This change should not affect normal DNS traffic.

Where it's fixed