Unbound DNS Resolver CVE-2026-56444

Exploitation requires Unbound to be configured with all three of the following non-default conditions simultaneously: (1) serve-expired: yes must be explicitly enabled; (2) discard-timeout must be set to a value greater than 0; (3) serve-expired-client-timeout must be set to a value strictly less than discard-timeout - the inverse of the recommended and shipped defaults. Additionally, the attacker must control or be able to influence a slow-responding authoritative DNS zone that the target resolver will query. Unbound installations running shipped defaults (serve-expired-client-timeout: 1800, discard-timeout: 1900) are NOT vulnerable because the discard-timeout branch is unreachable in that configuration. Limiting factors: non-default misconfiguration required; attacker must sustain a slow authoritative zone to repeatedly trigger the code path; exploitation degrades service progressively rather than causing immediate denial.

The CVSS 3.1 score of 5.9 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H accurately captures the primary risk profile: the vulnerability is network-reachable without authentication but carries high attack complexity because exploitation requires a specific non-default misconfiguration AND attacker control over a slow authoritative zone. Critically, Unbound's shipped defaults (serve-expired-client-timeout: 1800, discard-timeout: 1900) render the branch unreachable because the client timeout exceeds the discard timeout - the vulnerable condition inverts this relationship. This means the realistic affected population is administrators who have manually configured these parameters contrary to documentation guidance. No EPSS score was provided in available data, and this vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation. The tags in the source data label this 'Information Disclosure', which conflicts with the actual impact of availability degradation - this appears to be a mislabeled tag; no confidentiality impact is described in the vendor advisory or CVSS vector. Real-world priority is moderate: operators running the affected configuration should patch promptly, but default deployments are not exposed.

An attacker who operates or has influence over a slow-responding authoritative DNS zone sends repeated queries to a misconfigured Unbound resolver for names in that zone. Because the authoritative response is deliberately delayed, Unbound enters the serve-expired path; the discard-timeout fires first due to the misconfigured timeout ordering, incrementing the reply-address counter without a corresponding decrement. After sufficient iterations, the counter reaches its maximum value and the resolver silently drops all new clients querying the same names, effectively denying resolution service for targeted or broadly queried domains.