AI analysis
NLnetLabs Unbound versions 1.20.0 through 1.26.0 contain a flaw on the 'serve-expired' code path that double-decrements the per-client-IP 'wait-limit' counter, one of the countermeasures introduced against the DNSBomb amplification issue (CVE-2024-33655). An attacker who controls an authoritative zone with a short TTL alternates 'slow' queries that the attacker's authoritative server never answers with 'pump' queries for expired cached names, which are answered immediately via serve-expired and decrement the counter twice. By repeating this pattern, the attacker keeps the per-client counter at or below the configured wait-limit indefinitely and can accumulate an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread). This undermines a DNSBomb defense and erodes resolver availability; the flaw is rated CVSS 3.7 (low), with network vector, high attack complexity, and low availability-only impact. Any operator running Unbound 1.20.0-1.26.0 is exposed, most critically recursive resolvers with serve-expired enabled; no public PoC is known, it is not in CISA KEV, and no exploitation has been reported.
What to do: Upgrade to an NLnet Labs Unbound release newer than 1.26.0 that addresses CVE-2026-77860 as soon as one is available. As an interim mitigation, disable serve-expired ('serve-expired: no') since the flaw lives entirely on that code path, and review wait-limit and num-queries-per-thread settings. Monitor resolver logs for a single source IP alternating never-answered 'slow' queries with queries for expired cached names; note this is a separate, low-severity issue from the Unbound DNSSEC validator RCE reported in recent headlines.
Affected
| NLnet Labs Unbound | 1.20.0 through and including 1.26.0 (serve-expired code path) |
Estimated exposure
mass≈100,000+ resolver deployments (only the subset running 1.20.0-1.26.0 with 'serve-expired' enabled are exploitable) — Unbound is one of the most widely deployed open-source recursive resolvers — it is the default DNS resolver in pfSense/OPNsense, ships with common BSD/Linux stacks, and is common at ISPs — and public open-resolver scans have long counted…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.