A fault in the serve‑expired code path of Unbound causes the wait‑limit counter to be decremented twice for a single client IP. An attacker who controls an authoritative zone with short TTLs can repeatedly send slow queries that never complete, followed by queries for recently expired cached names that are served via serve‑expired. Each such pair both decrements the counter, keeping the value at or below the configured limit and allowing the attacker to accumulate many pending queries from one IP, up to the global per‑thread limit. This can sustain high loads and exhaust server resources, effectively denying service to legitimate clients.

NLnet Labs Unbound versions 1.20.0 up to and including 1.26.0 are affected. Any installation of Unbound in that range that has not been updated to 1.26.1 or later remains vulnerable.

The CVSS score of 3.7 indicates moderate severity. The EPSS score is below 1 %, and the vulnerability is not listed in CISA’s KEV catalog. The exploit is network‑based and requires the attacker to control an authoritative zone with short TTLs; it does not require local privileges on the resolver. Because the vulnerable path is reachable via port 53, the attack vector is inferred to be remote. An attacker can use this mechanism to keep the per‑IP counter low indefinitely, allowing a sustained denial of service against legitimate clients.