CVE-2026-41637
published 2026-07-22CVE-2026-41637: In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in…
PriorityP418low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.27%
18.7th percentile
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nlnet_labs | unbound | >= 1.22.0 < 1.25.2 | 1.25.2 |
| nlnetlabs | unbound | — | — |
| nlnetlabs | unbound | >= 1.22.0 < 1.25.2 | 1.25.2 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of re
ghsa_unreviewed·2026-07-22
CVE-2026-41637 [LOW] CWE-772 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of re
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution fo
Red Hat
unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries
vendor_redhat·2026-07-22·CVSS 3.7
CVE-2026-41637 [LOW] CWE-911 unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries
unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries
A flaw was found in Unbound, a Domain Name System (DNS) resolver. A remote attacker can exploit this vulnerability by sending and immediately terminating DNS-over-QUIC (DoQ) queries. This improper handling of terminated queries can lead to a build-up of pending responses, causing a degradation of service for new clients and ultimately a Denial of Service (DoS).
Statement: This vulnerability is rated as Low impact. Unbound, as distributed in Red Hat products, is not typically configured with DNS-over-QUIC (DoQ) support enabled by default. Exploitation requires Unbound to be explicitly compiled with `--with-libngtcp2` and have `quic-port` configured, in addition to an attacker bypassing default rate limits with multip
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-41637 unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries [fedora-all]
bugzilla·2026-07-28·CVSS 3.7
CVE-2026-41637 [LOW] CVE-2026-41637 unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries [fedora-all]
CVE-2026-41637 unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on im
Bugzilla
CVE-2026-41637 unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries
bugzilla·2026-07-22·CVSS 3.7
CVE-2026-41637 [LOW] CVE-2026-41637 unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries
CVE-2026-41637 unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the m
2026-07-22
Published