CVE-2026-77860

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*

History

23 Sep 2026, 20:21

Type	Values Removed	Values Added
CPE		cpe:2.3:a:nlnetlabs:unbound::::::::
References	~~() https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt -~~	() https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt - Patch, Vendor Advisory
First Time		Nlnetlabs Nlnetlabs unbound

Information

Published : 2026-09-16 09:17

Updated : 2026-09-23 20:21

NVD link : CVE-2026-77860

Mitre link : CVE-2026-77860

CVE.ORG link : CVE-2026-77860

JSON object : View

Products Affected

nlnetlabs

unbound

CWE

CWE-675

Multiple Operations on Resource in Single-Operation Context

{"id": "CVE-2026-77860", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77860", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-16T14:45:26.867772Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "sep@nlnetlabs.nl", "affectedData": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.20.0", "lessThan": "1.26.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T09:17:05.623", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt", "tags": ["Patch", "Vendor Advisory"], "source": "sep@nlnetlabs.nl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "description": [{"lang": "en", "value": "CWE-675"}]}], "descriptions": [{"lang": "en", "value": "In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path."}], "lastModified": "2026-09-23T20:21:00.757", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "474A8E1D-9E53-4612-A200-C292B22ED5E7", "versionEndExcluding": "1.26.1", "versionStartIncluding": "1.20.0"}], "operator": "OR"}]}], "sourceIdentifier": "sep@nlnetlabs.nl"}