In Unbound 1.22.0 through 1.25.1 a bug in the DNS‑over‑QUIC implementation allows the QUIC connection to skip the per‑stream `quic-size` limit. Because only a two‑byte length prefix is received before large buffers are allocated, a remote client can declare 65535‑byte payloads on both streams and hold them open with minimal traffic. The responder then unnecessarily allocates memory for the anticipated payloads, causing the program to exceed the configured `quic-size` budget, potentially exhaust memory, and crash or consume persistent high resources.

This vulnerability affects NLnet Labs Unbound installations that were built with QUIC support enabled via the `--with-libngtcp2`1.22.0 through 1.25.1 are vulnerable; later patched versions are not.

The CVSS score of 7.5 indicates a high impact from a remote network attack, and the EPSS score of <1% suggests a low probability of exploitation, but the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the DoS arises from a memory‑accounting bypass with no privilege escalation, allowing an attacker to launch it from any remote IP. The likely attack vector is a standard QUIC connection to the resolver, and the potential impact is that the resolver may become unavailable due to memory exhaustion or crash. The risk remains significant for providers that keep DoQ enabled and have not applied the upgrade.