EUVD-2026-80286
GHSA-8483-8qxh-jcf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconControl authoritative zone with short TTLs
-
DeliveryPrime resolver cache then let entries expire
-
ExploitSend unanswered 'slow' query
-
InstallSend 'pump' query hitting serve-expired path
-
C2Double-decrement wait-limit counter
-
ExecuteAccumulate pending queries to mesh quota
-
ImpactExhaust per-thread query slots (DoS)
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Requires the resolver to have the non-default 'serve-expired' feature enabled (the entire flaw lives on the serve-expired code path). The attacker must control an authoritative zone configured with short TTLs so victim cache entries expire quickly, and must be able to interleave two query types per cycle: a 'slow' query the attacker's authoritative deliberately never answers, and an immediately following 'pump' query for an expired cached name answered via serve-expired. Limiting factors: High attack complexity (precise slow/pump alternation and control of an authoritative zone), dependence on non-default serve-expired configuration, and impact capped at exhausting one thread's pending-query quota (num-queries-per-thread) rather than crashing the service - it only bypasses one of several DNSBomb (CVE-2024-33655) countermeasures. No authentication or user interaction required (PR:N/UI:N). |
| Impact | This is a low-priority DoS-class defense-in-depth bypass, not a high-impact vulnerability. The vendor CVSS of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) is well-calibrated: the only impact is availability (A:L), with no confidentiality or integrity effect, and attack complexity is High because the attacker must control an authoritative zone with short TTLs and precisely alternate 'slow' queries with 'pump' queries against an expired cached name to keep the per-client wait-limit counter suppressed. Critically, the flaw only weakens ONE of several countermeasures added for DNSBomb (CVE-2024-33655) - it lets a single source IP hold pending queries up to the global mesh quota (num-queries-per-thread) rather than achieving amplification or resolver crash. No EPSS, KEV, or POC data was provided; per the precision rules this is 'no public exploit identified at time of analysis.' There is no SSVC decision data. The most significant metadata conflict is the 'RCE' tag, which is flatly contradicted by the CVSS vector (C:N/I:N/A:L) and CWE-675 - there is no code execution; this is a counter-logic double-decrement DoS. Additionally, exploitation is gated on the non-default 'serve-expired' feature being enabled, further narrowing real-world exposure. |
| Exploit ScenarioDerived | An attacker registers/controls an authoritative zone served with very short TTLs so cached entries at a victim recursive resolver expire quickly. They repeatedly send a 'slow' query the authoritative never answers, immediately followed by a 'pump' query for an expired cached name that the serve-expired path answers instantly and decrements the per-client wait-limit counter twice. By alternating these, they hold an arbitrary number of pending queries from one source IP up to the thread's global query quota, degrading resolver availability. No public exploit code was identified at time of analysis, and attack complexity is High. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
NLnet Labs Unbound 1.20.0 through 1.26.0 can be made to accumulate an unbounded number of pending recursive queries from a single source IP because a double decrement on the per-client 'wait-limit' counter occurs on the 'serve-expired' code path. A remote, unauthenticated attacker who controls an authoritative zone with short TTLs alternates a deliberately unanswered 'slow' query with a 'pump' query for an expired cached name, keeping the counter at or below the configured limit and eventually filling a thread's global mesh quota (num-queries-per-thread), thereby bypassing one of the countermeasures introduced for DNSBomb (CVE-2024-33655). Impact is availability-only and limited (CVSS 3.7, AC:H, A:L) and depends on the non-default 'serve-expired' feature; no public exploit has been identified at time of analysis.
RemediationAI
Patch available per vendor advisory: consult the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt for the fixed Unbound release and upgrade affected 1.20.0-through-1.26.0 installations; the exact fixed version number is not stated in the provided data, so take it from the vendor advisory rather than assuming one. Where an immediate upgrade is not possible, the most direct mitigation is to disable the 'serve-expired' option in unbound.conf - the vulnerability exists solely on that code path, and the trade-off is that clients will no longer receive stale-but-served answers, so expired records return SERVFAIL/timeouts and perceived resolution latency increases during upstream outages. As secondary compensating controls, operators can lower 'wait-limit' and 'num-queries-per-thread' to reduce how much per-thread pending-query state an attacker can occupy (at the cost of legitimate traffic being more easily throttled), and deploy response rate limiting (RRL) or edge ACLs to restrict which networks may send recursive queries to the resolver, accepting that this narrows legitimate client reachability. Note that 'wait-limit' tuning alone does not eliminate the double-decrement bypass, since the attacker's alternation is designed to stay under that limit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Unbound is a validating, recursive, caching DNS resolver. The flaw lives entirely on the 'serve-expired' code path, an optional feature (disabled by default) that lets the resolver answer from an expired cache entry while it refreshes the record in the background. Unbound uses a per-client-IP 'wait-limit' counter as one of several mitigations added after the DNSBomb attack class (CVE-2024-33655), which abused the resolver's query pipeline to amplify traffic through delayed responses. In this case, when a query is answered via serve-expired, the wait-limit accounting is decremented twice for what should be a single operation, matching CWE-675 (multiple operations on a resource in a single-threaded context: the same counter is manipulated more times than the logic intends). An attacker controlling an authoritative zone with very short TTLs forces rapid cache expiry, then interleaves two query types from one source IP: a 'slow' query that the attacker's authoritative server never answers (holding a slot), and a 'pump' query for the just-expired cached name that is served immediately via serve-expired. Because the pump decrements the counter twice, the attacker can keep net pending-query state below the configured wait-limit indefinitely and hold pending queries up to the global per-thread mesh quota (num-queries-per-thread). The CPE string cpe:2.3:a:nlnet_labs:unbound identifies the affected product family. Note that some community tagging metadata associates this CVE with RCE (see the 'RCE' tag in the input), but the vendor advisory, the CVSS vector (C:N/I:N/A:L) and this assessment are consistent in showing an availability-only defense-in-depth bypass; the RCE label is not supported by any evidence in the provided data.
Know when Unbound gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable and unauthenticated, but AC:H due to required authoritative-zone control and precise slow/pump timing; only availability affected (A:L), gated by non-default serve-expired.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
2DescriptionCVE.org
In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC
Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker wh
Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIF
Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone
Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-fr
Denial-of-service through algorithmic complexity attacks in NLnet Labs Unbound up to and including 1.26.0 can degrade or
Exploit-DB