CVE-2026-41637

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41637", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "state": "PUBLISHED", "assignerShortName": "NLnet Labs", "dateReserved": "2026-06-22T10:11:10.518Z", "datePublished": "2026-07-22T13:04:52.605Z", "dateUpdated": "2026-07-22T14:29:25.088Z"}, "containers": {"cna": {"title": "Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries", "datePublic": "2026-07-22T00:00:00.000Z", "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"version": "1.22.0", "status": "affected", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "Unbound compiled with DoQ support ('--with-libngtcp2')"}], "cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-772", "description": "CWE-772: Missing Release of Resource after Effective Lifetime", "type": "CWE"}]}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.25.2"}], "timeline": [{"time": "2026-05-22T00:00:00.000Z", "lang": "en", "value": "Issue reported by Qifan Zhang"}, {"time": "2026-06-17T00:00:00.000Z", "lang": "en", "value": "NLnet Labs shares patch"}, {"time": "2026-06-17T00:00:00.000Z", "lang": "en", "value": "Qifan Zhang verifies patch"}, {"time": "2026-07-22T00:00:00.000Z", "lang": "en", "value": "Fixes released with version 1.25.2"}], "credits": [{"lang": "en", "value": "Qifan Zhang (Palo Alto Networks)", "type": "finder"}], "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41637.txt", "tags": ["vendor-advisory"]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-07-22T13:04:52.605Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T14:29:10.891526Z", "id": "CVE-2026-41637", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:29:25.088Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41637", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T14:29:10.891526Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:29:17.367Z"}}], "cna": {"title": "Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries", "credits": [{"lang": "en", "type": "finder", "value": "Qifan Zhang (Palo Alto Networks)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "scenarios": [{"lang": "en", "value": "Unbound compiled with DoQ support ('--with-libngtcp2')"}]}], "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.22.0", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-22T00:00:00.000Z", "value": "Issue reported by Qifan Zhang"}, {"lang": "en", "time": "2026-06-17T00:00:00.000Z", "value": "NLnet Labs shares patch"}, {"lang": "en", "time": "2026-06-17T00:00:00.000Z", "value": "Qifan Zhang verifies patch"}, {"lang": "en", "time": "2026-07-22T00:00:00.000Z", "value": "Fixes released with version 1.25.2"}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.25.2"}], "datePublic": "2026-07-22T00:00:00.000Z", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41637.txt", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-772", "description": "CWE-772: Missing Release of Resource after Effective Lifetime"}]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-07-22T13:04:52.605Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41637", "state": "PUBLISHED", "dateUpdated": "2026-07-22T14:29:25.088Z", "dateReserved": "2026-06-22T10:11:10.518Z", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "datePublished": "2026-07-22T13:04:52.605Z", "assignerShortName": "NLnet Labs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Unbound", "vendor": "NLnet Labs", "versions": [{"lessThan": "1.25.2", "status": "affected", "version": "1.22.0", "versionType": "semver"}]}], "source": "sep@nlnetlabs.nl"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C48102E-1D81-4A87-898D-F1CE83C78D26", "versionEndExcluding": "1.25.2", "versionStartIncluding": "1.22.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option."}, {"lang": "es", "value": "En NLnet Labs Unbound 1.22.0 hasta la versi\u00f3n 1.25.1 inclusive, las consultas DNS-over-QUIC (DoQ) terminadas por el cliente no son contabilizadas correctamente por Unbound, lo que resulta en una inflaci\u00f3n de bajo costo del n\u00famero de respuestas en espera para consultas de resoluci\u00f3n ya en curso. Esto resulta en una degradaci\u00f3n del servicio de resoluci\u00f3n para nuevos clientes para consultas ya en curso. Un actor malicioso puede explotar la vulnerabilidad emitiendo consultas DoQ para nombres de consulta que necesitan resoluci\u00f3n y procediendo a terminar inmediatamente la consulta mediante uno de los frames QUIC STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE. Esas consultas DoQ terminadas no se contabilizan correctamente y siguen inflando el n\u00famero de respuestas en espera para consultas en curso. Cuando se alcanza el m\u00e1ximo, resulta en ca\u00eddas silenciosas de consultas para nuevos clientes que necesitan resoluci\u00f3n para consultas ya en curso. Esta vulnerabilidad requiere que Unbound sea compilado con soporte DoQ (\u2019--with-libngtcp2\u2019) y que el \u2019quic-port\u2019 sea configurado para las interfaces de escucha. Adem\u00e1s, un actor malicioso necesita acceso a m\u00faltiples IPs de origen para eludir la opci\u00f3n \u2019wait-limit\u2019 configurada por defecto."}], "id": "CVE-2026-41637", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "sep@nlnetlabs.nl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41637", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T14:29:10.891526Z", "version": "2.0.3"}}]}, "published": "2026-07-22T14:17:18.560", "references": [{"source": "sep@nlnetlabs.nl", "tags": ["Vendor Advisory"], "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41637.txt"}], "sourceIdentifier": "sep@nlnetlabs.nl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-772"}], "source": "sep@nlnetlabs.nl", "type": "Secondary"}]}

{"bugzilla": {"description": "unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries", "id": "2506143", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506143"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in Unbound, a Domain Name System (DNS) resolver. A remote attacker can exploit this vulnerability by sending and immediately terminating DNS-over-QUIC (DoQ) queries. This improper handling of terminated queries can lead to a build-up of pending responses, causing a degradation of service for new clients and ultimately a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, completely disable DNS-over-QUIC (DoQ) support by removing or commenting out the quic-port directive in your Unbound configuration.\nRestart the Unbound service to apply the changes and clear any lingering resource limits."}, "name": "CVE-2026-41637", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "unbound", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-22T13:04:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-41637\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41637\nhttps://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41637.txt"], "statement": "This vulnerability is rated as Low impact. Unbound, as distributed in Red Hat products, is not typically configured with DNS-over-QUIC (DoQ) support enabled by default. Exploitation requires Unbound to be explicitly compiled with `--with-libngtcp2` and have `quic-port` configured, in addition to an attacker bypassing default rate limits with multiple source IPs. This makes successful exploitation difficult in standard Red Hat deployments.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.22.0,1.25.2)"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Unbound", "source": "cna", "vendor": "NLnet Labs"}, "product": "unbound", "vendor": "nlnetlabs"}], "created": "2026-07-23T19:00:17.243526+00:00", "updated": "2026-08-02T18:15:04.372864+00:00", "vendors": ["nlnetlabs", "nlnetlabs$PRODUCT$unbound"]}