CVE-2026-32665: NLnet Labs Unbound DoS Vulnerability

CVE-2026-32665 Overview

CVE-2026-32665 is a remote denial-of-service vulnerability in NLnet Labs Unbound versions 1.22.0 through 1.25.1. The flaw resides in the downstream DNS-over-QUIC (DoQ) implementation. When DoQ is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and stream_id 4) bypass the per-stream quic-size gate. Large input buffers are allocated after only the 2-byte length prefix arrives. A remote client can force Unbound to exceed the configured quic-size limit with minimal traffic, causing memory exhaustion and denial of service for new DoQ clients [CWE-1284].

Critical Impact
A single QUIC connection with two open streams declaring 65535-byte length prefixes can make Unbound allocate roughly double the configured quic-size limit, denying service to new DoQ clients.

Affected Products

NLnet Labs Unbound 1.22.0 through 1.25.1 (compiled with --with-libngtcp2)
Unbound deployments with quic-port configured on listening interfaces
DNS resolver services exposing DoQ to untrusted networks

Discovery Timeline

2026-07-22 - CVE-2026-32665 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-32665

Vulnerability Analysis

Unbound enforces a per-stream memory accounting limit through the quic-size configuration option. This gate is intended to bound the input buffer size that any single DoQ stream can allocate. The vulnerability stems from an ordering flaw. The gate is not applied to the first two bidirectional streams (stream_id 0 and stream_id 4) on a new QUIC connection. Instead, Unbound allocates the large input buffer after receiving only the 2-byte DoQ length prefix. An attacker declares a maximum-length prefix of 65535 bytes on each of the two initial streams, then holds the streams open without sending further data. Unbound commits memory based on the declared length while the accounting gate is bypassed. With a single connection, the attacker forces allocation of roughly twice the configured quic-size value. Sustained connections rapidly exhaust available memory and block new DoQ clients from being served.

Root Cause

The root cause is an improper enforcement of the quic-size limit against the DoQ stream lifecycle [CWE-1284]. Memory accounting is skipped for the initial two bidirectional streams of every new QUIC connection, and buffer allocation occurs before the declared payload is validated against the configured cap. See the NLnet Labs CVE-2026-32665 Report for the vendor analysis.

Attack Vector

The attack is remote and unauthenticated. An attacker opens a QUIC connection to the Unbound quic-port, initiates bidirectional streams 0 and 4, sends a 2-byte length prefix declaring 65535 bytes on each stream, and holds the streams open. Repeating this across connections amplifies memory pressure until Unbound cannot service additional DoQ clients.

No verified public exploit code is available at this time. See the NLnet Labs advisory for reproduction details.

Detection Methods for CVE-2026-32665

Indicators of Compromise

Sudden growth in Unbound resident memory correlated with inbound QUIC traffic on the configured quic-port
High counts of half-open DoQ streams with declared 65535-byte length prefixes and no follow-on payload
New DoQ clients failing to establish sessions while UDP/443 or the configured QUIC port remains reachable

Detection Strategies

Monitor Unbound process memory (RSS) and compare against the configured quic-size value to detect accounting drift
Inspect QUIC telemetry for connections that open multiple bidirectional streams and stall after sending only 2 bytes
Alert on repeated connections from the same source IP that hold streams open beyond a short handshake window

Monitoring Recommendations

Enable Unbound extended-statistics and scrape memory and QUIC counters into your metrics pipeline
Log per-connection QUIC stream events at the network edge or via eBPF for post-incident review
Trigger alerts when Unbound memory exceeds a defined threshold above the sum of configured caches and quic-size budgets

How to Mitigate CVE-2026-32665

Immediate Actions Required

Inventory Unbound instances compiled with --with-libngtcp2 and identify any with quic-port configured
Restrict access to the DoQ listening port to trusted networks using firewall rules or ACLs until patched
Disable DoQ by removing or commenting out quic-port in unbound.conf where the protocol is not required

Patch Information

Refer to the NLnet Labs CVE-2026-32665 Report for the fixed release version and upgrade guidance. Upgrade all Unbound instances above the vulnerable range 1.22.0 through 1.25.1 to a patched release published by NLnet Labs.

Workarounds

Disable DoQ by removing the quic-port directive from unbound.conf and reloading the service
Rebuild Unbound without --with-libngtcp2 on hosts that do not require DoQ support
Front Unbound with a QUIC-aware proxy or load balancer that enforces stream-level rate limits and memory caps

bash

# Configuration example: disable DoQ until patched
# /etc/unbound/unbound.conf
server:
    # quic-port: 853        # comment out to disable DNS-over-QUIC
    # quic-size: 8m         # gate is bypassed on stream_id 0 and 4 in vulnerable versions

# Reload Unbound to apply the change
sudo unbound-control reload