Executive brief
NLnetLabs Unbound is a DNS recursive resolver used by internet service providers and organizations to handle DNS queries. A flaw in the serve-expired feature allows an attacker to bypass query-rate limiting by sending specially crafted requests, potentially allowing them to exhaust server resources and cause denial of service.
Technical details
A double-decrement vulnerability exists in the serve-expired code path of Unbound that incorrectly processes the wait-limit counter per client IP. The vulnerability allows an attacker controlling an authoritative zone with short TTL values to alternate between slow queries (that never receive answers) and "pump" queries for expired cached entries (answered via serve-expired). Each pump query decrements the counter twice, allowing an attacker to keep the per-client counter at or below the configured wait-limit indefinitely, effectively bypassing the DNSBomb (CVE-2024-33655) countermeasure. An attacker can exploit this via network without authentication to hold arbitrary numbers of pending queries from a single source IP up to the global mesh quota. The vulnerability affects Unbound versions 1.20.0 through 1.26.0; a fix is available in version 1.26.1 or via patch application.
Affected products
- NLnetLabs Unbound 1.20.0 to 1.26.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix available in Unbound 1.26.1 and as a patch for 1.26.0