Skip to content

CVE-2026-41637 on CTRL-OS 26.05

Aliases: CVE-2026-41637

Packages: unbound

Status: In Progress

Advisory Information

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.

Updates

2026-07-27 19:41 CEST

Metadata changes:

  • Status for package unbound: “In Progress” (6adb4107d901bc4e75e7e4659d2eccdaebe38c21)

2026-07-23 23:53 CEST

Metadata changes:

  • Status for package unbound: “Plausible”

2026-07-23 23:53 CEST

Metadata changes:

  • Status for package unbound: “New”