CVE-2026-41637: NLnet Labs Unbound DoS Vulnerability

CVE-2026-41637 Overview

CVE-2026-41637 affects NLnet Labs Unbound versions 1.22.0 through 1.25.1. The vulnerability allows a remote attacker to degrade DNS resolution service through improperly tracked DNS-over-QUIC (DoQ) queries. Client-terminated DoQ queries are not correctly decremented from the waiting-replies counter for in-flight resolution queries. Once the maximum is reached, Unbound silently drops queries from new clients that require resolution of the same in-flight names. The flaw is tracked under [CWE-772] (Missing Release of Resource after Effective Lifetime).

Critical Impact
A remote attacker with access to multiple source IPs can inflate the waiting-replies counter for in-flight queries, causing silent query drops and degraded DNS resolution for legitimate clients.

Affected Products

NLnet Labs Unbound 1.22.0 through 1.25.1
Unbound builds compiled with DoQ support (--with-libngtcp2)
Unbound instances configured with quic-port on listening interfaces

Discovery Timeline

2026-07-22 - CVE-2026-41637 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-41637

Vulnerability Analysis

Unbound processes DNS-over-QUIC queries by tracking a waiting-replies counter for each in-flight resolution. When multiple clients request the same unresolved name, they queue against the pending upstream lookup. The counter is intended to bound resource consumption per in-flight query. Unbound fails to decrement this counter when a DoQ client terminates its stream before the resolution completes. Terminated queries continue to consume waiting-reply slots until the maximum is reached. New legitimate clients requesting resolution of the same name are then silently dropped without a response.

Root Cause

The root cause is a resource accounting error classified under [CWE-772]. Unbound does not release the waiting-reply slot when a client aborts a DoQ query using STOP_SENDING, RESET_STREAM, or CONNECTION_CLOSE QUIC frames. The slot remains allocated to a client that will never receive the answer. Repeated aborts accumulate until the pending queue saturates.

Attack Vector

An attacker issues DoQ queries for names that require upstream resolution. Immediately after sending each query, the attacker terminates the QUIC stream or connection using STOP_SENDING, RESET_STREAM, or CONNECTION_CLOSE frames. Each terminated query occupies a waiting-reply slot on the target resolver. The attacker must operate from multiple source IPs to bypass the default wait-limit per-IP throttle. Once the maximum is reached, new clients requesting the same in-flight names receive no response.

No verified proof-of-concept code is publicly available. See the NLnet Labs advisory for CVE-2026-41637 for authoritative technical details.

Detection Methods for CVE-2026-41637

Indicators of Compromise

Elevated rate of DoQ connections terminated with STOP_SENDING, RESET_STREAM, or CONNECTION_CLOSE frames shortly after query submission
Growing number of waiting replies for in-flight queries reported in Unbound statistics
Increased DoQ traffic volume originating from a distributed set of source IP addresses
Reports of intermittent DNS resolution failures from downstream clients using DoQ

Detection Strategies

Monitor Unbound unbound-control stats output for anomalies in num.query.tcp equivalents and pending query counters on the DoQ listener
Baseline normal DoQ stream lifetime and alert on high volumes of short-lived, prematurely terminated streams
Correlate QUIC packet captures on the quic-port interface to identify bursts of stream-reset frames

Monitoring Recommendations

Enable verbose logging on Unbound DoQ listeners and forward logs to a centralized analytics platform for baselining
Track resolution latency and query drop rates per client segment to detect service degradation early
Alert on sustained increases in aborted QUIC streams from diverse source IP ranges targeting the DNS resolver

How to Mitigate CVE-2026-41637

Immediate Actions Required

Upgrade Unbound to a version later than 1.25.1 that contains the fix once released by NLnet Labs
If upgrading is not immediately possible, disable DoQ by removing quic-port from the Unbound configuration
Restrict DoQ listener exposure to trusted networks using firewall rules or ACLs
Review wait-limit and related rate-limiting settings and tighten them for DoQ clients

Patch Information

Refer to the NLnet Labs advisory for CVE-2026-41637 for the fixed version and patch details. Operators should track NLnet Labs Unbound release announcements and apply the update as soon as it is available.

Workarounds

Rebuild Unbound without DoQ support by omitting the --with-libngtcp2 configure flag
Remove or comment out the quic-port directive in unbound.conf to disable the DoQ listener
Reduce the wait-limit value and configure stricter per-IP query limits to slow counter inflation
Front the resolver with a QUIC-aware proxy that enforces stream lifetime policies

bash

# Configuration example: disable DoQ in unbound.conf
server:
    # Comment out or remove the quic-port directive
    # quic-port: 853

    # Tighten wait-limit to reduce impact if DoQ must remain enabled
    wait-limit: 100
    wait-limit-cookie: 10000