Executive brief
NLnet Labs Unbound is a widely used DNS resolver that translates website names into IP addresses. A flaw in how it handles specific encrypted DNS-over-QUIC (DoQ) connections allows an attacker to artificially fill up the server's waiting list for queries. This can lead to a denial-of-service condition where legitimate users' requests are ignored or dropped, though it requires specific server configurations and multiple attacker IP addresses to execute.
Technical details
A resource management vulnerability (CWE-772) exists in Unbound's DNS-over-QUIC (DoQ) implementation. When a client terminates a DoQ query using QUIC frames such as STOP_SENDING, RESET_STREAM, or CONNECTION_CLOSE, Unbound fails to properly decrement the counter for waiting replies of in-flight resolution queries. An attacker can exploit this by repeatedly initiating and terminating queries, eventually reaching the maximum limit and causing the server to silently drop new legitimate queries for the same names. Exploitation requires Unbound to be compiled with '--with-libngtcp2', have 'quic-port' configured, and typically requires multiple source IPs to bypass the 'wait-limit' protection. The issue is resolved in Unbound version 1.25.2.
Affected products
- NLnet Labs Unbound 1.22.0 to 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in version 1.25.2