From bd71e3b8a6dd87682bf454dc3687fc9e70b1bb78 Mon Sep 17 00:00:00 2001 From: "W.C.A. Wijngaards" Date: Wed, 16 Sep 2026 09:29:04 +0200 Subject: [PATCH] - Fix CVE-2026-77860, 'serve-expired' can bypass Unbound 'wait-limit'. Thanks to Xuanchao Xie, Lutong Chen, and Kaiping Xue from the University of Science and Technology of China (USTC) for the report. --- services/mesh.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/services/mesh.c b/services/mesh.c index 6c52759ae..0360a0a86 100644 --- a/services/mesh.c +++ b/services/mesh.c @@ -2703,8 +2703,7 @@ mesh_serve_expired_callback(void* arg) if(r->query_reply.c->tcp_req_info) tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate); /* mesh_send_reply removed mesh state from http2_stream. */ - infra_wait_limit_dec(mstate->s.env->infra_cache, - &r->query_reply, mstate->s.env->cfg); + /* mesh_send_reply decremented wait_limit. */ prev = r; prev_buffer = r_buffer; }