CVE-2026-41637: Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
Other sources
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOPSENDING/RESETSTREAM/CONNECTIONCLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.25.2-1 - Upgrade
Upgrade
NLnet Labs Unboundto a version that resolves this vulnerability.Fixed in 1.25.2 - Configuration
Ensure Unbound is compiled with DoQ support by enabling '--with-libngtcp2'.
NLnet Labs Unbound (DoQ/QUIC) --with-libngtcp2 = enabled - Configuration
Configure the 'quic-port' to be set for the Unbound listening interfaces (as required for DoQ support).
NLnet Labs Unbound (DoQ/QUIC) quic-port = configured for listening interfaces
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41637?
CVE-2026-41637 has a low severity rating of 3.7.
What is the risk assessment for CVE-2026-41637?
CVE-2026-41637 has a risk score of 21.
How can CVE-2026-41637 affect DNS resolution services?
CVE-2026-41637 can lead to degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries.
Which versions of Unbound are affected by CVE-2026-41637?
CVE-2026-41637 affects NLnet Labs Unbound versions from 1.22.0 up to and including 1.25.1.
Is there a fix available for CVE-2026-41637?
As of now, specific mitigation details for CVE-2026-41637 are not provided in the description.