CVE-2026-32665

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.25.1

Description A memory-accounting bypass exists in the downstream DNS-over-QUIC (DoQ) implementation. When DoQ is enabled, the first two bidirectional streams on a new QUIC connection (stream id 0 and 4) bypass the per-stream quic-size gate. Large input buffers are allocated after the 2-byte length prefix is received from these initial streams, allowing a remote client to exceed the configured quic-size limit with minimal input. By sending a declared 65535-byte length prefix and keeping the streams open, a client can cause the system to allocate approximately double that amount, leading to a denial of service for new DoQ clients. This issue requires the software to be compiled with DoQ support using --with-libngtcp2 and the quic-port to be configured for listening interfaces.

Recommendations Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, disable the quic-port configuration on listening interfaces or avoid using the DoQ implementation if compiled with --with-libngtcp2.