Monthly
NLnet Labs Unbound 1.20.0 through 1.26.0 can be made to accumulate an unbounded number of pending recursive queries from a single source IP because a double decrement on the per-client 'wait-limit' counter occurs on the 'serve-expired' code path. A remote, unauthenticated attacker who controls an authoritative zone with short TTLs alternates a deliberately unanswered 'slow' query with a 'pump' query for an expired cached name, keeping the counter at or below the configured limit and eventually filling a thread's global mesh quota (num-queries-per-thread), thereby bypassing one of the countermeasures introduced for DNSBomb (CVE-2024-33655). Impact is availability-only and limited (CVSS 3.7, AC:H, A:L) and depends on the non-default 'serve-expired' feature; no public exploit has been identified at time of analysis.
NLnet Labs Unbound 1.20.0 through 1.26.0 can be made to accumulate an unbounded number of pending recursive queries from a single source IP because a double decrement on the per-client 'wait-limit' counter occurs on the 'serve-expired' code path. A remote, unauthenticated attacker who controls an authoritative zone with short TTLs alternates a deliberately unanswered 'slow' query with a 'pump' query for an expired cached name, keeping the counter at or below the configured limit and eventually filling a thread's global mesh quota (num-queries-per-thread), thereby bypassing one of the countermeasures introduced for DNSBomb (CVE-2024-33655). Impact is availability-only and limited (CVSS 3.7, AC:H, A:L) and depends on the non-default 'serve-expired' feature; no public exploit has been identified at time of analysis.