Description
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.
Published: 2026-07-22
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unbound versions 1.22.0 through 1.25.1 fail to correctly count client‑terminated DNS‑over‑QUIC (DoQ) queries, causing the server to inflate the counter for waiting replies. An attacker can repeatedly send DoQ queries, immediately close the QUIC stream with STOP_SENDING, RESET_STREAM or CONNECTION_CLOSE frames, and trick the resolver into thinking more queries are still in flight. When the counter reaches the configured limit, new legitimate queries are silently dropped, degrading the availability of the DNS resolution service. This weakness is closely related to CWE‑772 (Missing Release of Memory after Effective Lifetime) and CWE‑911 (Improper Control of Resource Allocation).

Affected Systems

NLnet Labs Unbound DNS resolver, versions 1.22.0 to 1.25.1 inclusive. The flaw manifests only when the server is compiled with DoQ support (--with-libngtcp2) and the 'quic-port' option is enabled. Systems exposing a DoQ service are affected; exploitation requires the ability to send QUIC frames from multiple source IPs to bypass the default wait‑limit setting.

Risk and Exploitability

The CVSS score of 3.7 indicates moderate severity, and the EPSS score is less than 1%, meaning the exploitation probability is low, though not zero. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the weakness over the network by sending DoQ queries from different IP addresses to inflate the waiting‑reply counter without needing privileged access. When the counter threshold is met, legitimate clients experience silent query drops, effectively causing a denial of service for those in‑flight queries.

Generated by OpenCVE AI on August 2, 2026 at 18:07 UTC.

Remediation

Vendor Solution

This issue is fixed starting with version 1.25.2

OpenCVE Recommended Actions

  • Upgrade Unbound to version 1.25.2 or later.
  • If an upgrade is not possible, disable the DoQ feature by removing the '--with-libngtcp2' flag at compile time and deleting any 'quic-port' configuration, which stops the vulnerable code path from executing.
  • Limit inbound QUIC connections or increase the 'wait-limit' configuration so that terminating DoQ queries from multiple source IPs cannot reach the threshold that triggers silent drops.

Generated by OpenCVE AI on August 2, 2026 at 18:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-911
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Nlnetlabs
Nlnetlabs unbound
Vendors & Products Nlnetlabs
Nlnetlabs unbound

Wed, 22 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Description In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.
Title Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
Weaknesses CWE-772
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Nlnetlabs Unbound
cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-07-22T14:29:25.088Z

Reserved: 2026-06-22T10:11:10.518Z

Link: CVE-2026-41637

cve-icon Vulnrichment

Updated: 2026-07-22T14:29:17.367Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T14:17:18.560

Modified: 2026-07-24T13:57:04.917

Link: CVE-2026-41637

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-22T13:04:52Z

Links: CVE-2026-41637 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T18:15:04Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime

  • CWE-911

    Improper Update of Reference Count