Xuanchao Xie

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.22.0 through 1.25.1 **Description** A memory-accounting bypass exists in the downstream DNS-over-QUIC (DoQ) implementation. When DoQ is enabled, the first two bidirectional streams on a new QUIC connection (stream id 0 and 4) bypass the per-stream `quic-size` gate. Large input buffers are allocated after the 2-byte length prefix is received from these initial streams, allowing a remote client to exceed the configured `quic-size` limit with minimal input. By sending a declared 65535-byte length prefix and keeping the streams open, a client can cause the system to allocate approximately double that amount, leading to a denial of service for new DoQ clients. This issue requires the software to be compiled with DoQ support using `--with-libngtcp2` and the `quic-port` to be configured for listening interfaces. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, disable the `quic-port` configuration on listening interfaces or avoid using the DoQ implementation if compiled with `--with-libngtcp2`.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.22.0 through 1.25.1 **Description** A remote unauthenticated client can terminate the entire resolver process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This occurs when `ngtcp2 conn writev stream()` returns `NGTCP2 ERR STREAM DATA BLOCKED`, leading Unbound to call `ngtcp2 ccerr set application error()` with a `-1` error value. This value is implicitly converted to `0xFFFFFFFFFFFFFFFF`, which exceeds the 62-bit variable-length integer ceiling during serialization in `ngtcp2 conn write connection close()`. Consequently, `ngtcp2 put uvarintlen()` fails an assertion, causing the process to abort. An attacker can trigger this by advertising `initial max stream data bidi local = 1` in transport parameters and sending a DoQ query without reading the stream. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1.