The CVE number for this vulnerability is CVE-2026-56444.


== Description
When Unbound is configured with 'serve-expired: yes' and
'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested
values), the discard-timeout branch during the serve expired logic drops an
aged client reply without performing the correct accounting for the number of
reply addresses for the query.
Other identical branches outside of serve expired perform the correct
decrement.
Since the counter is never decremented in such scenario, it can reach the
maximum limit and new clients for duplicate in-flight queries are silently
dropped resulting in degradation of resolution service.

A malicious actor can exploit the vulnerability by querying the resolver for a
client-controlled slow-on-demand authoritative zone that can drive the counter
past the threshold.

Shipped defaults for 'serve-expired-client-timeout: 1800' and 'discard-timeout:
1900' make the branch unreachable.

Unbound 1.25.2 includes a fix to properly account for the dropped replies.


== Affected products
Unbound 1.20.0 up to and including version 1.25.1.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-56444.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-56444.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks, also Xin Wang,
Jiapeng Li, and Jiajia Liu, Northwestern Polytechnical University, also Haruki
Oyama from Waseda University, for discovering and responsibly disclosing the
vulnerability.