This vulnerability affects NLnet Labs Unbound DNS resolver versions >=1.20.0 and <1.26.1. On the 'serve-expired' code path, a double decrement occurs on the 'wait-limit' counter per client IP, which was designed to limit pending queries as a defense against DNSBomb attacks (CVE-2024-33655). An attacker controlling an authoritative zone with short TTL can alternate slow queries that do not get answered and immediate 'pump' queries for expired cached names. This keeps the per-client counter artificially low, allowing the attacker to hold an arbitrary number of pending queries up to the global mesh quota, effectively bypassing the rate-limiting countermeasure.

The vulnerability allows an attacker to bypass a per-client query rate-limiting mechanism, potentially enabling resource exhaustion on the DNS resolver by holding many pending queries from a single source IP. The impact is limited to availability degradation (denial of service potential) with no confidentiality or integrity impact reported.

No explicit patch or official fix is indicated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitoring and limiting exposure to authoritative zones with short TTLs controlled by untrusted parties may reduce risk.