CVE-2026-41637

Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

LOW

3.7

CVSS Score

Published: July 22, 2026 at 01:04 PM UTC

Updated: October 24, 2026 at 01:10 PM UTC

1 product affected across 1 vendorUnbound

Using Unbound by NLnet Labs?

Get instant alerts when new vulnerabilities affect Unbound - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

LOW3.7

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.