Skip to main content

Unbound DNS Resolver CVE-2026-56444

| EUVDEUVD-2026-47685 MEDIUM
Missing Release of Resource after Effective Lifetime (CWE-772)
2026-07-22 NLnet Labs GHSA-x9gf-4mqv-47hw
Information Disclosure Unbound Red Hat Suse
5.9
CVSS 3.1 · Vendor: NLnet Labs
Share

Severity by source

Vendor (NLnet Labs) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

AV:N for remote DNS query delivery; AC:H for mandatory non-default misconfiguration plus attacker-controlled zone; no confidentiality or integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
3.7 LOW
qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 22, 2026 - 16:18 EUVD
Analysis Generated
Jul 22, 2026 - 13:57 vuln.today

DescriptionCVE.org

In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for 'serve-expired-client-timeout: 1800' and 'discard-timeout: 1900' make the branch unreachable.

AnalysisAI

Counter exhaustion in NLnet Labs Unbound 1.20.0 through 1.25.1 enables a remote attacker to degrade DNS resolution service by triggering a missing decrement in the serve-expired discard-timeout code path. The reply-address counter for duplicate in-flight queries is never decremented when the discard-timeout branch fires under a specific non-default misconfiguration, allowing an attacker controlling a slow authoritative zone to drive the counter to its maximum and cause silent query drops for legitimate clients. No public exploit identified at time of analysis; however, the vulnerability is exploitable remotely with no authentication required once the misconfiguration is in place.

Technical ContextAI

Unbound is a validating, recursive DNS resolver maintained by NLnet Labs, widely deployed in ISP, enterprise, and embedded environments. The affected code path involves the serve-expired feature (RFC-aligned stale-while-revalidate behavior) and its interaction with two timeout parameters: serve-expired-client-timeout and discard-timeout. When a duplicate in-flight query arrives and the discard-timeout fires before the serve-expired-client-timeout, Unbound enters a branch that drops the aged client reply without decrementing the internal counter tracking the number of reply addresses pending for that query. Parallel branches in the non-serve-expired code path perform the correct decrement. The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime) - specifically a reference counter leak that accumulates without bound. The CPE cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:* covers all affected versions from 1.20.0 to 1.25.1 inclusive.

RemediationAI

Consult the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-56444.txt for the patched release; no exact fix version was confirmed in available intelligence at time of analysis. As an immediate workaround with no service disruption, ensure that serve-expired-client-timeout is set to a value greater than discard-timeout, matching the shipped defaults (serve-expired-client-timeout: 1800, discard-timeout: 1900) - this makes the vulnerable branch unreachable without disabling serve-expired functionality. Alternatively, setting discard-timeout: 0 disables the discard-timeout feature entirely, eliminating the vulnerable branch at the cost of potentially holding aged replies longer. Disabling serve-expired: yes entirely is the most conservative workaround but removes stale-cache serving capability. Review current Unbound configuration for any inversion of these timeout values before patch availability.

More in Unbound

View all
CVE-2019-18934 HIGH POC
7.3 Nov 19

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
CVE-2026-33278 CRITICAL
9.1 May 20

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
CVE-2026-42959 HIGH
8.7 May 20

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
CVE-2026-42944 HIGH
8.7 May 20

Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
CVE-2026-32665 HIGH
7.5 Jul 22

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
CVE-2026-55973 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone

CVE-2026-40691 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
CVE-2026-44690 HIGH
7.5 Jul 22

DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
CVE-2022-3204 HIGH
7.5 Sep 26

A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
CVE-2020-10772 HIGH
7.5 Nov 27

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020
CVE-2020-12663 HIGH
7.5 May 19

Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Rated high severity
CVE-2020-12662 HIGH
7.5 May 19

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. Rated high severity

Same weakness CWE-772 – Missing Release of Resource after Effective Lifetime

View all
CVE-2017-14495 HIGH POC
7.5
CVE-2024-20481 MEDIUM
5.8
CVE-2017-14138 CRITICAL POC
9.8
CVE-2020-12134 CRITICAL POC
9.8
CVE-2018-19760 HIGH POC
8.8
CVE-2017-13748 HIGH POC
7.5
CVE-2017-15268 HIGH POC
7.5
CVE-2017-11655 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2026-56444 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy