Xuanchao Xie

A flaw in the 'serve-expired' code path allows a double decrement of the `wait-limit` counter per client IP. An attacker can exploit this by controlling an authoritative zone with short Time to Live (TTL) values to ensure cached entries expire rapidly. By alternating between slow queries (which the attacker's authoritative server never answers) and pump queries (queries for expired cached names answered via the 'serve-expired' path), the attacker can keep the per-client counter at or below the `wait-limit` indefinitely. This allows a single source IP to maintain an arbitrary number of pending queries up to the global mesh quota `num-queries-per-thread`, bypassing a counter measure designed to prevent DNSBomb attacks.

A memory-accounting bypass exists in the downstream DNS-over-QUIC (DoQ) implementation. When DoQ is enabled, the first two bidirectional streams on a new QUIC connection (stream id 0 and 4) bypass the per-stream `quic-size` gate. Large input buffers are allocated after the 2-byte length prefix is received from these initial streams, allowing a remote client to exceed the configured `quic-size` limit with minimal input. By sending a declared 65535-byte length prefix and keeping the streams open, a client can cause the system to allocate approximately double that amount, leading to a denial of service for new DoQ clients. This issue requires the software to be compiled with DoQ support using `--with-libngtcp2` and the `quic-port` to be configured for listening interfaces.

A remote unauthenticated client can terminate the entire resolver process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This occurs when `ngtcp2 conn writev stream()` returns `NGTCP2 ERR STREAM DATA BLOCKED`, leading Unbound to call `ngtcp2 ccerr set application error()` with a `-1` error value. This value is implicitly converted to `0xFFFFFFFFFFFFFFFF`, which exceeds the 62-bit variable-length integer ceiling during serialization in `ngtcp2 conn write connection close()`. Consequently, `ngtcp2 put uvarintlen()` fails an assertion, causing the process to abort. An attacker can trigger this by advertising `initial max stream data bidi local = 1` in transport parameters and sending a DoQ query without reading the stream.