CVE-2026-56444

A Denial of Service (DoS) flaw exists in Unbound under specific serve-expired and discard-timeout configurations. By sending crafted queries, a remote attacker can exhaust an internal counter, causing the server to drop new legitimate client queries and degrade resolution services.

This Low-impact flaw in Unbound can lead to a denial of service. While a remote attacker could exhaust the reply address counter with specially crafted queries, Red Hat products are not affected by default. The vulnerability requires specific non-default serve-expired and discard-timeout configurations, which are not present in standard Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that Unbound is configured with serve-expired-client-timeout not greater than discard-timeout when serve-expired: yes is enabled. Alternatively, disable the serve-expired feature if it is not required. Red Hat's default configurations for Unbound prevent this vulnerability from being exploited.