CVE-2026-56444: NLnet Labs Unbound DoS Vulnerability

CVE-2026-56444 Overview

CVE-2026-56444 affects NLnet Labs Unbound versions 1.20.0 through 1.25.1. The vulnerability resides in the serve-expired logic when the resolver is configured with serve-expired: yes and serve-expired-client-timeout > discard-timeout > 0. The discard-timeout branch drops an aged client reply without decrementing the reply-address counter for the query. Identical branches outside the serve-expired path perform the correct accounting. The counter eventually reaches its maximum limit, causing new clients for duplicate in-flight queries to be silently dropped. This produces a degradation of DNS resolution service. Shipped default values (serve-expired-client-timeout: 1800 and discard-timeout: 1900) make the vulnerable branch unreachable.

Critical Impact
A remote attacker can query the resolver for a client-controlled slow authoritative zone to drive the internal counter past its threshold, causing silent drops of legitimate client queries and degraded DNS resolution.

Affected Products

NLnet Labs Unbound 1.20.0 through 1.25.1
Deployments explicitly configured with serve-expired: yes
Deployments where serve-expired-client-timeout > discard-timeout > 0 (non-default)

Discovery Timeline

2026-07-22 - CVE-2026-56444 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-56444

Vulnerability Analysis

Unbound tracks the number of reply addresses associated with each in-flight query. When a query is served under the serve-expired path and the discard-timeout branch triggers, the aged client reply is discarded without decrementing this counter. Every parallel branch outside the serve-expired logic correctly performs the decrement. This asymmetric handling of resource accounting corresponds to [CWE-772: Missing Release of Resource after Effective Lifetime].

Over time, repeated triggering of the vulnerable branch drives the counter toward its maximum. Once the threshold is reached, Unbound silently drops new client requests for duplicate in-flight queries. The result is a persistent denial-of-service condition affecting resolution for any client that shares an in-flight query with the exhausted state.

Root Cause

The root cause is missing accounting on a resource release path. The discard-timeout branch inside the serve-expired logic omits the decrement of the reply-address counter that peer branches perform. The bug is only reachable when an operator explicitly sets serve-expired-client-timeout greater than discard-timeout, both non-zero, contrary to the values suggested by upstream documentation.

Attack Vector

An attacker controls or points the resolver at a slow-on-demand authoritative zone. By repeatedly issuing queries for names in that zone, the attacker keeps client-side timeouts firing under the serve-expired path. Each triggered discard-timeout branch leaks a counter increment. Eventually the counter saturates and the resolver stops accepting duplicate in-flight client requests. Exploitation requires network access to the resolver but no authentication or user interaction. Attack complexity is high because the target must run the specific non-default configuration.

No verified public exploit code is available. See the NLnet Labs CVE-2026-56444 Notice for the vendor's technical description.

Detection Methods for CVE-2026-56444

Indicators of Compromise

Rising counts of duplicate in-flight queries being dropped by Unbound with no corresponding upstream failure
Repeated client-facing SERVFAIL or timeout responses for popular names that resolve correctly on a peer resolver
Sustained queries directed at a single slow-responding authoritative zone from external sources

Detection Strategies

Audit Unbound configuration files for serve-expired: yes combined with serve-expired-client-timeout greater than discard-timeout, both non-zero
Inspect Unbound statistics (unbound-control stats_noreset) for growth in dropped queries and stalled in-flight query counters
Compare resolution success rates between resolver instances to identify a single degraded node

Monitoring Recommendations

Alert on sustained increases in num.query.tcp, num.query.dropped, and in-flight query gauges
Log and review outbound queries to newly observed, slow-responding authoritative name servers
Track client-side resolution latency and failure ratios per resolver instance for anomaly identification

How to Mitigate CVE-2026-56444

Immediate Actions Required

Verify whether serve-expired: yes is enabled and, if so, confirm that serve-expired-client-timeout is less than or equal to discard-timeout
Restore the shipped defaults serve-expired-client-timeout: 1800 and discard-timeout: 1900, which make the vulnerable branch unreachable
Restart Unbound after configuration changes and validate resolution behavior under load

Patch Information

Refer to the NLnet Labs CVE-2026-56444 Notice for the fixed release version and vendor guidance. Upgrade Unbound to a version above 1.25.1 that includes the accounting fix in the serve-expired discard-timeout branch.

Workarounds

Set serve-expired-client-timeout equal to or below discard-timeout, or disable serve-expired entirely if not required
Rate-limit or block queries to slow-on-demand authoritative zones identified as abuse sources
Deploy multiple resolver instances behind a load balancer to reduce blast radius until patching is complete

bash

# Configuration example - restore safe defaults in unbound.conf
server:
    serve-expired: yes
    serve-expired-client-timeout: 1800
    discard-timeout: 1900
    # Ensure: serve-expired-client-timeout <= discard-timeout