The CVE number for this vulnerability is CVE-2026-77860.


== Summary
A vulnerability on the serve-expired code path can cause a double decrement on
the wait-limit counter per client IP essentially bypassing one of the counter
measures that was introduced for DNSBomb (CVE-2024-33655).

Unbound 1.26.1 includes a fix that removes the double wait-limit decrement on
the serve-expired code path.


== Affected products
Unbound 1.20.0 up to and including version 1.26.0.


== Description
A malicious actor can exploit this by controlling an authoritative zone with
short TTL, so cached entries expire quickly.
Each 'slow' query, one the attacker's authoritative never answers, is followed
by one query for an expired cached name, which is answered immediately via the
serve-expired path and decrements the counter twice.
This second query was named 'pump'.
By alternating slow queries and pumps, the attacker keeps the per-client
counter at or below the configured wait-limit indefinitely, and can hold an
arbitrary number of pending queries from a single source IP, up to the global
mesh quota (num-queries-per-thread); eventually bypassing one of the counter
measures introduced for DNSBomb (CVE-2024-33655).

This vulnerability is present on the serve-expired code path.

Unbound 1.26.1 includes a fix that removes the double wait-limit decrement on
the serve-expired code path.


== Mitigation

=== Downloading patched version
Unbound 1.26.1 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz

=== Applying the patch manually
For Unbound 1.26.0 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-77860.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-77860.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.26.0.


== Acknowledgments
We would like to thank Xuanchao Xie, Lutong Chen, and Kaiping Xue from the
University of Science and Technology of China (USTC) for discovering and
responsibly disclosing the vulnerability.