WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-21 17:27:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

- Fix CVE-2026-77860, 'serve-expired' can bypass Unbound 'wait-limit'.

Browse Source 
Thanks to Xuanchao Xie, Lutong Chen, and Kaiping Xue from the
  University of Science and Technology of China (USTC) for the
  report.
This commit is contained in:
W.C.A. Wijngaards
2026-09-16 09:29:04 +02:00
parent 3a6ba0da81
commit bd71e3b8a6
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/mesh.c
+1 -2
View File
@@ -2703,8 +2703,7 @@ mesh_serve_expired_callback(void* arg)
if(r->query_reply.c->tcp_req_info)
tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
/* mesh_send_reply removed mesh state from http2_stream. */
infra_wait_limit_dec(mstate->s.env->infra_cache,
&r->query_reply, mstate->s.env->cfg);
/* mesh_send_reply decremented wait_limit. */
prev = r;
prev_buffer = r_buffer;
}