CVE-2026-56444: NLnet Labs Unbound resource exhaustion in serve-expired logic

CVE-2026-56444 · Severity: medium · CVSS 5.9 · Published 2026-07-22

NLnet Labs Unbound, a widely used DNS resolver that translates domain names into IP addresses, contains a flaw that can lead to a service outage. Under specific non-default configurations, the system fails to properly track active network requests, eventually reaching a limit that prevents new users from accessing the service. An attacker can exploit this by forcing the system to handle slow requests, effectively blocking legitimate traffic and degrading network reliability.

Technologies: NLnet Labs Unbound. Vendors: NLnet Labs.

Quick answers

Is CVE-2026-56444 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56444 being exploited in the wild.
How severe is CVE-2026-56444?
Medium severity, with a CVSS score of 5.9, published 22 July 2026.
Which products and versions are affected?
NLnet Labs Unbound 1.20.0 up to and including 1.25.1.
Is there a fix for CVE-2026-56444?
A patch was published on 2026-07-22: Unbound version 1.25.2 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56444 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56444?
Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource management vulnerability (CWE-772) exists in NLnet Labs Unbound versions 1.20.0 through 1.25.1 when configured with 'serve-expired: yes' and a 'serve-expired-client-timeout' greater than 'discard-timeout'. In this specific configuration, the discard-timeout branch fails to decrement the counter for the number of reply addresses associated with a query when dropping an aged client reply. An attacker can exploit this by querying the resolver for a slow, attacker-controlled authoritative zone, causing the counter to reach its maximum limit. Once the limit is reached, Unbound silently drops new clients for duplicate in-flight queries, resulting in a denial-of-service. The issue is resolved in version 1.25.2.

Affected products

  • NLnet Labs Unbound 1.20.0 up to and including 1.25.1

Timeline

  • 2026-07-22: advisory: Initial advisory published by NLnet Labs and NVD
  • 2026-07-22: patched: Unbound version 1.25.2 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.