CVEFinder.io

CVE-2026-77860

ℹī¸ low
Summary

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an exp

Description

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.

CVSS Score
3.7
Low
EPSS Score
0.3
Exploit Probability
Published Date
2026-09-16
First Seen: 2026-09-18
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 3.9% of all 365,968 vulnerabilities in our database.

#351,809
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Sep 16, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
🏆 Discovered By
Xuanchao Xie (University of Science and Technology of China) Lutong Chen (University of Science and Technology of China) Kaiping Xue (University of Science and Technology of China)
SSVC data provided by CISA
Last Modified 2026-09-23
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE IDs (Weakness Types)
CWE-675

đŸ“Ļ Affected Products 1

Vendor Product Status Affected Versions
nlnetlabs unbound Affected
> 1.20.0 < 1.26.1

🔗 References 1

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-...
Patch Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-77955 đŸ”ļ medium 4.4 0.2 In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) ... 2026-09-16
CVE-2026-78227 đŸ”ļ medium 6.5 0.3 NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC... 2026-09-16
CVE-2026-80225 đŸ”ļ medium 5.3 0.5 In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT readin... 2026-09-16
CVE-2026-81634 ⚠ī¸ high 7.5 0.5 In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap b... 2026-09-16
CVE-2026-81642 ⛔ critical 9.8 1.0 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial ... 2026-09-16
CVE-2026-82717 ⛔ critical 9.8 0.8 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memor... 2026-09-16
These CVEs affect the same products