Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-41637— Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

CVSS 3.7 · Low EPSS 0.27% · P19

Possible ATT&CK Techniques 1AI

T1498.002 · Reflection Amplification

Affected Version Matrix 1

VendorProductVersion RangeStatus
NLnet LabsUnbound1.22.0< 1.25.2affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-41637

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
Source: CVE Program / CVE List V5
Vulnerability Description
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对已超过有效生命周期的资源丧失索引
Source: CVE Program / CVE List V5
Vulnerability Title
NLnet Labs Unbound 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NLnet Labs Unbound是荷兰NLnet Labs组织的域名系统解析服务器。 NLnet Labs Unbound 1.22.0版本至1.25.1版本存在资源管理错误漏洞，该漏洞源于对客户终止的DNS-over-QUIC（DoQ）查询处理不当，可能导致已发送查询的等待回复数量膨胀，造成新客户端解析服务降级。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
NLnet LabsUnbound 1.22.0 ~ 1.25.2 -

II. Public POCs for CVE-2026-41637

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-41637

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-41637 (1)

Same Patch Batch · NLnet Labs · 2026-07-22 · 24 CVEs total

CVE-2026-559737.5 HIGH'dns-error-reporting: yes' leads to stack buffer overflow
CVE-2026-326657.5 HIGHRemote DNS-over-QUIC denial of service due to `quic-size` budget bypass
CVE-2026-406917.5 HIGHPacket of death for DNSCrypt over TCP
CVE-2026-446907.5 HIGHCross-zone wildcard cache poisoning via RRSIG.labels manipulation
CVE-2026-502486.5 MEDIUMBOGUS configured primary hostname accepted for XFR in auth/rpz zones
CVE-2026-528635.9 MEDIUMMemory corruption could lead to crash and denial of service
CVE-2026-557175.9 MEDIUM'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash
CVE-2026-559915.9 MEDIUMRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
CVE-2026-559905.9 MEDIUMPacket of death for a DNSCrypt misconfigured Unbound
CVE-2026-564445.9 MEDIUMDegradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout
CVE-2026-145865.9 MEDIUMAssertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
CVE-2026-446215.9 MEDIUMLibunbound applications configured with 'unwanted-reply-threshold' could eventually be abr
CVE-2026-500465.9 MEDIUMPossible heap use-after-free in an error path when a DoT forwarded query is jostled out
CVE-2026-500455.3 MEDIUM'max-global-quota' reset by DNSSEC validation restarts
CVE-2026-502515.3 MEDIUMAttacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush
CVE-2026-564164.8 MEDIUMPossible heap buffer overflow when validator canonicalizes RDATA that contains domain name
CVE-2026-465823.7 LOWA wildcard replay, as another piece of data, triggers poisoning in the serve expired reply
CVE-2026-446873.7 LOWOff-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legi
CVE-2026-544783.7 LOWDNS Cookie bypass when combined with proxy-protocol use
CVE-2026-429553.7 LOWExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-tim

Showing top 20 of 24 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Unbound
Same vendor: NLnet Labs
Same weakness: CWE-772

V. Comments for CVE-2026-41637

No comments yet

Leave a comment