3.7 LOW
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): Low (L)
Activity log
- Created suggestion
Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.
References
-
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41637.txt vendor-advisory
Affected products
- <1.25.2
Matching in nixpkgs
pkgs.unbound
Validating, recursive, and caching DNS resolver
pkgs.unbound-full
Validating, recursive, and caching DNS resolver
pkgs.unbound-with-systemd
Validating, recursive, and caching DNS resolver
pkgs.luaPackages.luaunbound
A binding to libunbound
pkgs.lua51Packages.luaunbound
A binding to libunbound
pkgs.lua52Packages.luaunbound
A binding to libunbound
pkgs.lua53Packages.luaunbound
A binding to libunbound
pkgs.lua54Packages.luaunbound
A binding to libunbound
pkgs.lua55Packages.luaunbound
A binding to libunbound
pkgs.luajitPackages.luaunbound
A binding to libunbound
pkgs.prometheus-unbound-exporter
Prometheus exporter for Unbound DNS resolver
pkgs.python313Packages.pyunbound
Python library for Unbound, the validating, recursive, and caching DNS resolver
pkgs.python314Packages.pyunbound
Python library for Unbound, the validating, recursive, and caching DNS resolver
pkgs.haskellPackages.unbound-generics
Support for programming with names and binders using GHC Generics
pkgs.haskellPackages.unbounded-delays
Unbounded thread delays and timeouts
pkgs.haskellPackages.unbound-kind-generics
Support for programming with names and binders using kind-generics
Package maintainers
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
-
@Scrumplex Sefa Eyeoglu <contact@scrumplex.net>