CVEFinder.io

CVE-2026-41637

ℹī¸ low
🔍 Scan for this CVE
Summary

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the q

Description

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.

CVSS Score
3.7
Low
EPSS Score
0.3
Exploit Probability
Published Date
2026-07-22
First Seen: 2026-07-23
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 3.9% of all 364,858 vulnerabilities in our database.

#350,722
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Jul 22, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
🏆 Discovered By
Qifan Zhang (Palo Alto Networks)
SSVC data provided by CISA
Last Modified 2026-07-24
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE IDs (Weakness Types)
CWE-772

đŸ“Ļ Affected Products 1

Vendor Product Status Affected Versions
nlnetlabs unbound Affected
> 1.22.0 < 1.25.2

🔗 References 1

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-77860 ℹī¸ low 3.7 0.3 In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a dou... 2026-09-16
CVE-2026-77955 đŸ”ļ medium 4.4 0.2 In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) ... 2026-09-16
CVE-2026-78227 đŸ”ļ medium 6.5 0.3 NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC... 2026-09-16
CVE-2026-80225 đŸ”ļ medium 5.3 0.5 In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT readin... 2026-09-16
CVE-2026-81634 ⚠ī¸ high 7.5 0.5 In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap b... 2026-09-16
CVE-2026-81642 ⛔ critical 9.8 1.0 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial ... 2026-09-16
These CVEs affect the same products