CVE-2026-56444
Received Received - Intake

Denial of Service in Unbound DNS Resolver

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for 'serve-expired-client-timeout: 1800' and 'discard-timeout: 1900' make the branch unreachable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-56444
EUVD
EUVD-2026-47685

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound to 1.25.1 (inc)
nlnet_labs unbound From 1.20.0 (inc) to 1.25.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-772 The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56444 is a flaw in Unbound DNS software versions 1.20.0 to 1.25.1. It occurs when Unbound is misconfigured with 'serve-expired: yes' and specific timeout values where 'serve-expired-client-timeout' exceeds 'discard-timeout'. This causes the software to fail to decrement a counter when dropping aged client replies, leading to a counter overflow that silently drops new clients for duplicate queries and degrades DNS resolution.

Detection Guidance

Check Unbound version with 'unbound -V' to confirm if it is between 1.20.0 and 1.25.1. Verify configuration files for 'serve-expired: yes' and timeout values where 'serve-expired-client-timeout' > 'discard-timeout' > 0 using commands like 'grep serve-expired /etc/unbound/unbound.conf' and 'grep -E 'serve-expired-client-timeout|discard-timeout' /etc/unbound/unbound.conf'.

Impact Analysis

This vulnerability can degrade DNS resolution service by causing legitimate client queries to be silently dropped. An attacker could exploit it by querying a slow authoritative zone they control to push the counter past its limit, resulting in denial of service for other users relying on the resolver.

Compliance Impact

This vulnerability primarily impacts DNS resolution service availability rather than directly affecting data protection standards like GDPR or HIPAA. However, degraded DNS resolution could indirectly impact compliance by disrupting secure communications or access to critical services, potentially affecting data processing or system integrity requirements.

Mitigation Strategies

Upgrade Unbound to version 1.25.2 or later. If upgrading is not possible, manually patch the affected versions by applying the fix from NLnet Labs. Ensure configuration does not use 'serve-expired: yes' with 'serve-expired-client-timeout' > 'discard-timeout' > 0.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56444. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart