Log in Start free

Vulnerability · Published Jul 22, 2026 · Assigned by NLnet Labs

CVE-2026-41637Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

Low 3.7

In plain English

A low-severity security flaw in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 69.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12unboundno fix listedDEBIAN-CVE-2026-41637
Debian:13unbound1.26.1-0+deb13u1DEBIAN-CVE-2026-41637
Debian:14unbound1.25.2-1DEBIAN-CVE-2026-41637
Ubuntu:22.04:LTSunboundno fix listedUBUNTU-CVE-2026-41637
Ubuntu:24.04:LTSunboundno fix listedUBUNTU-CVE-2026-41637
Ubuntu:26.04:LTSunboundno fix listedUBUNTU-CVE-2026-41637
Ubuntu:26.10unboundno fix listedUBUNTU-CVE-2026-41637

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound 1.22.0 – before 1.25.2

Weakness: CWE-772 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References