Executive brief
A vulnerability in the Unbound DNS resolver could allow an attacker to crash or disable the service by exhausting its memory. By sending specifically crafted requests using the DNS-over-QUIC protocol, a remote user can bypass security limits and force the server to allocate excessive resources. This results in a denial of service, preventing legitimate users from resolving domain names.
Technical details
A vulnerability exists in Unbound's downstream DNS-over-QUIC (DoQ) implementation where the first two bidirectional streams (IDs 0 and 4) of a new connection bypass the 'quic-size' memory limit validation. An attacker can send a 2-byte length prefix declaring a large payload (up to 65535 bytes) without actually sending the data, forcing Unbound to allocate large input buffers prematurely. By maintaining these open streams, a remote unauthenticated attacker can exceed configured memory budgets with minimal effort, leading to a denial of service for subsequent DoQ clients. This issue affects Unbound versions 1.22.0 through 1.25.1 when compiled with 'libngtcp2' and configured with a 'quic-port'. The vulnerability is addressed in version 1.25.2.
Affected products
- NLnet Labs Unbound 1.22.0 through 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in Unbound 1.25.2