CVE-2026-41637
Received Received - Intake

DoQ Query Termination Inflation in Unbound

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-41637
EUVD
EUVD-2026-47665

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-772 The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-41637 is a flaw in NLnet Labs Unbound DNS software versions 1.22.0 to 1.25.1. It involves improper handling of terminated DNS-over-QUIC (DoQ) queries, causing an artificial increase in waiting replies for active resolution queries. This degrades DNS resolution service for new clients when the waiting limit is reached, leading to silent query drops.

Detection Guidance

To detect this vulnerability, check if Unbound is running with DoQ support by verifying the compilation flag '--with-libngtcp2' and if 'quic-port' is configured in the Unbound configuration file. Monitor for unusual spikes in waiting replies or silent query drops for new clients during high DoQ query activity.

Impact Analysis

If you use Unbound with DoQ support enabled and a configured QUIC port, an attacker could exploit this to degrade or disrupt DNS resolution services. This may cause delays or failures in resolving domain names for legitimate users, particularly if the attacker has access to multiple source IPs.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it primarily affects DNS resolution service availability rather than data privacy or security controls. However, service degradation or silent query drops could indirectly affect systems relying on DNS for compliance-related logging or audit trails.

Mitigation Strategies

Immediately upgrade Unbound to version 1.25.2 or apply the manual patch provided by NLnet Labs. Disable DoQ support by removing '--with-libngtcp2' during compilation and unsetting 'quic-port' in the configuration if DoQ is not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41637. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart