CVE-2026-77860: NLnetLabs Unbound DNS DoS Vulnerability

CVE-2026-77860 Overview

CVE-2026-77860 affects NLnet Labs Unbound, an open-source recursive DNS resolver. The vulnerability resides in the serve-expired code path and causes a double decrement of the wait-limit counter tracked per client IP address. This flaw weakens one of the countermeasures introduced to mitigate the earlier DNSBomb amplification attack tracked as CVE-2024-33655. Attackers can exploit the counter accounting error to hold an arbitrary number of pending queries from a single source IP, bounded only by the global num-queries-per-thread mesh quota. The issue affects Unbound versions 1.20.0 through 1.26.0 inclusive.

Critical Impact
Attackers who control an authoritative zone can bypass the per-client wait-limit counter and saturate a resolver's global query mesh from a single source IP.

Affected Products

NLnet Labs Unbound 1.20.0 through 1.26.0
Deployments using the default serve-expired code path
Recursive resolvers relying on wait-limit as a DNSBomb countermeasure

Discovery Timeline

2026-09-16 - CVE-2026-77860 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77860

Vulnerability Analysis

The vulnerability is a counter accounting error [CWE-675] in Unbound's mesh state handling. Unbound tracks a per-client-IP wait-limit counter to cap the number of concurrent slow queries a single source can hold open. This limit was added as one of several DNSBomb countermeasures. On the serve-expired code path, the counter is decremented twice for a single response event, allowing sustained bypass of the intended cap.

The practical result is that a single source IP can hold pending queries up to the global num-queries-per-thread mesh quota. This exhausts resolver capacity and degrades service for legitimate clients, producing a denial-of-service condition against the recursive resolver.

Root Cause

The root cause is duplicate accounting on the serve-expired response path. When Unbound answers a query from expired cached data, it decrements the per-client wait-limit counter twice for what should be a single unit of work. The counter therefore drifts lower than the true number of outstanding queries attributable to the client, defeating the enforcement logic.

Attack Vector

An attacker operates an authoritative DNS zone configured with short time-to-live (TTL) values so cached entries expire quickly. The attacker then sends alternating query types to a victim resolver:

A slow query for a name that the attacker's authoritative server never answers, consuming a mesh slot.
A pump query for a previously cached name that has now expired, which Unbound answers immediately via the serve-expired path.

Each pump triggers the double decrement, freeing counter budget faster than the resolver actually reclaims mesh slots. By alternating slow queries and pumps, the attacker keeps the observed per-client counter at or below the configured wait-limit indefinitely while holding many real queries in flight. Exploitation requires an attacker-controlled authoritative zone and sustained traffic, which raises attack complexity.

Detection Methods for CVE-2026-77860

Indicators of Compromise

Sustained high volume of queries from a single client IP against short-TTL attacker-controlled zones.
Elevated counts of serve-expired responses correlated with unanswered upstream queries to the same authoritative nameservers.
Growth in num-queries-per-thread utilization without a matching increase in unique client IPs.

Detection Strategies

Correlate Unbound unbound-control stats output for mem.mod.iterator, num.query.tcp, and mesh.jostled counters against expected baselines.
Alert when a single source IP sustains pending mesh states above the configured wait-limit for extended periods.
Monitor authoritative zones associated with inbound resolver traffic for anomalously short TTLs combined with high non-response rates.

Monitoring Recommendations

Enable Unbound extended statistics and export them to a centralized logging or SIEM pipeline for trend analysis.
Track per-client query rates and mesh occupancy, not just aggregate query counts.
Baseline normal serve-expired response ratios so deviations trigger investigation.

How to Mitigate CVE-2026-77860

Immediate Actions Required

Upgrade NLnet Labs Unbound to the fixed release identified in the NLnet Labs CVE-2026-77860 Advisory.
Inventory all recursive resolvers running Unbound 1.20.0 through 1.26.0 and prioritize internet-facing instances.
Review resolver logs for sustained single-source query pressure that matches the alternating slow-and-pump pattern.

Patch Information

Refer to the NLnet Labs CVE-2026-77860 Advisory for the fixed version and upgrade instructions. The patch corrects the double decrement on the serve-expired code path so that the per-client wait-limit counter accurately reflects outstanding queries.

Workarounds

Disable the serve-expired feature until the patched version is deployed, accepting the associated cache-freshness tradeoff.
Lower num-queries-per-thread to reduce the maximum impact a single abusive source can impose on the resolver.
Restrict recursive service to trusted client networks using access-control to remove exposure to untrusted source IPs.

bash

# Configuration example: temporary mitigation in unbound.conf
server:
    serve-expired: no
    num-queries-per-thread: 512
    access-control: 192.0.2.0/24 allow
    access-control: 0.0.0.0/0 refuse