{
  "cveId": "CVE-2026-77860",
  "url": "https://patchblox.com/security/cve/CVE-2026-77860",
  "summary": "CVE-2026-77860 is fixed in unbound on 1 platform, first by DEBIAN-CVE-2026-77860, released September 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "\u0027serve-expired\u0027 can bypass Unbound \u0027wait-limit\u0027",
  "description": "In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the \u0027serve-expired\u0027 code path can cause a double decrement on the \u0027wait-limit\u0027 counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each \u0027slow\u0027 query, one the attacker\u0027s authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the \u0027serve-expired\u0027 path and decrements the counter twice. This second query was named \u0027pump\u0027. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured \u0027wait-limit\u0027 indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the \u0027serve-expired\u0027 code path.",
  "published": "2026-09-16T09:17:05Z",
  "severity": "low",
  "cvss": 3.7,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "cwe": "Multiple Operations on Resource in Single-Operation Context",
  "epss": 0.00301,
  "epssPercentile": 0.2299,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77860",
  "fixes": [
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.26.1-0\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-77860",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-77860",
      "released": "2026-09-19T18:30:58Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Debian 14",
      "fixedVersion": "1.26.1-1",
      "fix": "DEBIAN-CVE-2026-77860",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-77860",
      "released": "2026-09-19T18:30:58Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.26.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22082-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22082-1",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "sles 15.6",
      "fixedVersion": "1.26.1-150600.23.24.1",
      "fix": "SUSE-SU-2026:4620-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4620-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "sles 15.7",
      "fixedVersion": "1.26.1-150600.23.24.1",
      "fix": "SUSE-SU-2026:4620-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4620-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "sles 16.0",
      "fixedVersion": "1.26.1-160000.1.1",
      "fix": "SUSE-SU-2026:24226-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24226-1",
      "released": "2026-11-07T00:45:20Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}