CVE-2026-41637 in Unbound
Summary
by MITRE • 07/22/2026
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability in NLnet Labs Unbound DNS resolver affects versions 1.22.0 through 1.25.1 and represents a sophisticated denial-of-service condition that exploits the improper handling of DNS-over-QUIC client connections. The flaw manifests when clients terminate DNS-over-QUIC queries prematurely using QUIC termination frames such as STOP_SENDING, RESET_STREAM, or CONNECTION_CLOSE. These terminated queries are not properly accounted for in Unbound's internal tracking mechanisms, leading to a persistent inflation of the waiting replies counter for existing in-flight resolution requests. The vulnerability operates at the protocol implementation level where the resolver fails to correctly manage connection state transitions and resource accounting for QUIC-based DNS queries.
The technical impact extends beyond simple resource exhaustion into service degradation that affects legitimate client operations. When terminated DoQ queries are improperly counted, they continue to inflate the internal waiting reply counter for in-flight queries, effectively consuming available slots in Unbound's resolution queue. This creates a cascading effect where new legitimate queries cannot be processed because the system believes it is still waiting for responses to terminated connections. The vulnerability specifically requires Unbound to be compiled with DoQ support using the '--with-libngtcp2' configuration option and must have the 'quic-port' configured for listening interfaces, indicating this is a feature-specific vulnerability rather than a core protocol issue. The attack vector necessitates multiple source IP addresses to bypass the default 'wait-limit' protection mechanism that would otherwise prevent abuse.
From a cybersecurity perspective, this vulnerability aligns with CWE-400 (Uncontrolled Resource Consumption) and represents an implementation weakness in connection state management within DNS resolution services. The attack pattern follows established adversarial techniques documented in MITRE ATT&CK framework under T1498 (Network Denial of Service) and potentially T1566 (Phishing with Social Engineering). The malicious actor can exploit this by crafting DoQ queries for names requiring resolution and immediately terminating them, creating a resource inflation attack that degrades service quality for legitimate users. This represents a low-cost but effective method of service disruption since the attacker only needs to establish QUIC connections and terminate them rather than perform complex attacks against the underlying infrastructure.
The operational impact affects DNS resolution reliability and availability, particularly in high-traffic environments where DoQ support is enabled. When the maximum waiting reply limit is reached, new client queries experience silent drops instead of proper error responses, leading to potential service unavailability for legitimate users who may retry their queries without understanding why they failed. Organizations using Unbound with DoQ support should immediately evaluate their deployment configurations and consider implementing additional mitigations such as restricting access to QUIC listeners or adjusting wait-limit parameters to prevent exploitation. The vulnerability demonstrates the importance of proper resource accounting in high-performance DNS implementations where protocol features like QUIC can introduce unexpected attack surfaces if not properly integrated with existing security controls and resource management mechanisms.