CVE-2026-77860

A vulnerability in Unbound's serve-expired code path allows a remote attacker to bypass pending-query limits using specially crafted DNS queries. By causing a security counter to double-decrement, the attacker can hold an arbitrary number of pending queries from a single source, resulting in a Denial of Service (DoS) condition.

This flaw in Unbound allows a remote attacker controlling an authoritative DNS zone to bypass query rate-limiting safeguards and exhaust server capacity via specially crafted queries. The impact is assessed as Low because exploitation is restricted to non-default environments where the serve-expired directive is explicitly enabled, and successfully triggering the issue requires complex preconditions and precise query timing rather than enabling direct, unconstrained service disruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the 'serve-expired' option in the Unbound configuration. This can be achieved by setting 'serve-expired: no' in the 'unbound.conf' file. A restart of the Unbound service is required for the changes to take effect. Disabling this feature may impact the availability of stale DNS records.