Kaihua Wang

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.22.0 through 1.25.1 **Description** In DNS-over-QUIC (DoQ) environments, high concurrency and system pressure can trigger an assertion in the `libngtcp2` library regarding monotonic timestamps. This occurs because Unbound uses realtime instead of the expected monotonic time when interfacing with `libngtcp2`, leading to server termination and a denial of service. This issue requires Unbound to be compiled with DoQ support using the `--with-libngtcp2` flag and the `quic-port` to be configured for the listening interfaces. **Recommendations** For versions 1.22.0 through 1.25.1, update the software to a version where this issue is resolved. As a temporary mitigation, avoid configuring the `quic-port` for listening interfaces or disable DNS-over-QUIC support.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.22.0 through 1.25.1 **Description** A memory-accounting bypass exists in the downstream DNS-over-QUIC (DoQ) implementation. When DoQ is enabled, the first two bidirectional streams on a new QUIC connection (stream id 0 and 4) bypass the per-stream `quic-size` gate. Large input buffers are allocated after the 2-byte length prefix is received from these initial streams, allowing a remote client to exceed the configured `quic-size` limit with minimal input. By sending a declared 65535-byte length prefix and keeping the streams open, a client can cause the system to allocate approximately double that amount, leading to a denial of service for new DoQ clients. This issue requires the software to be compiled with DoQ support using `--with-libngtcp2` and the `quic-port` to be configured for listening interfaces. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, disable the `quic-port` configuration on listening interfaces or avoid using the DoQ implementation if compiled with `--with-libngtcp2`.