The CVE number for this vulnerability is CVE-2026-41637.


== Summary
Client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by
Unbound resulting in low-cost inflation of the waiting number of replies for
already in-flight resolution queries.
This results in degradation of resolution service for new clients for already
in-flight queries.

Unbound 1.25.2 includes a fix to properly account the terminated DoQ queries.


== Affected products
Unbound 1.22.0 up to and including version 1.25.1.


== Description
A malicious actor can exploit the vulnerability by issuing DoQ queries for
query names that need resolution and proceeding on immediately terminating the
query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames.
Those terminated DoQ queries are not properly counted for and keep inflating
the number of waiting replies for in-flight queries.
When the maximum is reached, it results in silent query drops for new clients
needing resolution for already in-flight queries.

This vulnerability needs Unbound to be compiled with DoQ support
('--with-libngtcp2') and the 'quic-port' to be configured for the listening
interfaces.
Additionally, a malicious actor needs access to multiple source IPs to bypass
the by-default configured 'wait-limit' option.

Unbound 1.25.2 includes a fix to properly account the terminated DoQ queries.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-41637_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-41637_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-41637.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.