In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout >… (CVE-2026-56444)

In NLnet Labs Unbound versions 1.20.0 up to and including 1.25.1, if configured with 'serve-expired: yes' and 'serve-expired-client-timeout' set higher than 'discard-timeout' (which is contrary to recommended settings), a logic branch in the serve expired code path fails to decrement a counter tracking reply addresses. This counter can reach its maximum limit, causing new clients for duplicate in-flight queries to be silently dropped, resulting in degraded DNS resolution service. The vulnerability can be exploited by an attacker querying a slow-on-demand authoritative zone under their control to drive the counter past the threshold. The default shipped configuration ('serve-expired-client-timeout: 1800' and 'discard-timeout: 1900') makes this vulnerable code path unreachable.

The vulnerability causes degradation of DNS resolution service by silently dropping new client queries when a counter tracking reply addresses is not decremented properly. There is no confidentiality or integrity impact reported. Exploitation requires specific configuration and attacker-controlled slow authoritative zones. The CVSS score is 5.9 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to availability.

Ensure that Unbound is configured with 'serve-expired-client-timeout' less than or equal to 'discard-timeout' as recommended. The shipped default configuration already prevents this vulnerability by making the problematic code branch unreachable. No additional patch or fix is indicated in the provided data. Verify configuration settings to avoid the vulnerable scenario.