The CVE number for this vulnerability is CVE-2026-32665.


== Summary
When downstream DNS-over-QUIC (DoQ) is enabled, Unbound documents the
'quic-size' configuration option as the maximum number of bytes for all QUIC
buffers and data combined, and states that new connections or streams should
be refused/reset once the limit is exceeded.
However, an improper validation of the client provided length could allow over
allocating memory and trivially exceeding the configured budget for future DoQ
connections leading to denial of service for new DoQ clients.

Unbound 1.25.2 includes a fix to properly budget QUIC streams against the
'quic-size' configuration disallowing clients to over allocate memory.


== Affected products
Unbound 1.22.0 up to and including version 1.25.1.


== Description
When downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional
streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream
'quic-size' gate entirely, and large input buffers are allocated later, after
only the 2-byte length prefix has been received from the initial streams.

As a result, a remote client can make Unbound exceed the configured 'quic-size'
limit with low-cost input.
Using only one connection and two streams, each sending a declared 65535-byte
length prefix and then holding the streams open, a client can already trivially
make Unbound roughly allocate double that amount.

This is a remote availability issue / memory-accounting bypass in the
downstream DoQ implementation that leads to denial of service for new DoQ
clients.

This vulnerability needs Unbound to be compiled with DoQ support
('--with-libngtcp2') and the 'quic-port' to be configured for the listening
interfaces.

Unbound 1.25.2 includes a fix to properly budget QUIC streams against the
'quic-size' configuration disallowing clients to over allocate memory.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-32665.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-32665.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank GitHub user 'N0zoM1z0'. Additionally, Kunta Chu,
Kaihua Wang and Jianjun Chen from Tsinghua University, Qifan Zhang from Palo
Alto Networks and Xuanchao Xie for discovering and responsibly disclosing the
vulnerability.