Kunta Chu

A lifetime bug exists in DNS-over-QUIC (DoQ) when operating in multi-threaded mode. A remote DoQ client can trigger a QUIC path migration, causing the system to enter stream or connection cleanup while a mesh reply still holds a pointer to the DoQ stream. This results in a use-after-free condition where the cleanup process frees the DoQ stream, and the subsequent completion of the pending mesh reply dereferences a stale pointer, leading to a crash.

In DNS-over-QUIC (DoQ) environments, high concurrency and system pressure can trigger an assertion in the `libngtcp2` library regarding monotonic timestamps. This occurs because Unbound uses realtime instead of the expected monotonic time when interfacing with `libngtcp2`, leading to server termination and a denial of service. This issue requires Unbound to be compiled with DoQ support using the `--with-libngtcp2` flag and the `quic-port` to be configured for the listening interfaces.

A memory-accounting bypass exists in the downstream DNS-over-QUIC (DoQ) implementation. When DoQ is enabled, the first two bidirectional streams on a new QUIC connection (stream id 0 and 4) bypass the per-stream `quic-size` gate. Large input buffers are allocated after the 2-byte length prefix is received from these initial streams, allowing a remote client to exceed the configured `quic-size` limit with minimal input. By sending a declared 65535-byte length prefix and keeping the streams open, a client can cause the system to allocate approximately double that amount, leading to a denial of service for new DoQ clients. This issue requires the software to be compiled with DoQ support using `--with-libngtcp2` and the `quic-port` to be configured for listening interfaces.