CVE-2026-41637

{
  "id": "CVE-2026-41637",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-22T14:17:18.560",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option."
    },
    {
      "lang": "es",
      "value": "En NLnet Labs Unbound 1.22.0 hasta la versión 1.25.1 inclusive, las consultas DNS-over-QUIC (DoQ) terminadas por el cliente no son contabilizadas correctamente por Unbound, lo que resulta en una inflación de bajo costo del número de respuestas en espera para consultas de resolución ya en curso. Esto resulta en una degradación del servicio de resolución para nuevos clientes para consultas ya en curso. Un actor malicioso puede explotar la vulnerabilidad emitiendo consultas DoQ para nombres de consulta que necesitan resolución y procediendo a terminar inmediatamente la consulta mediante uno de los frames QUIC STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE. Esas consultas DoQ terminadas no se contabilizan correctamente y siguen inflando el número de respuestas en espera para consultas en curso. Cuando se alcanza el máximo, resulta en caídas silenciosas de consultas para nuevos clientes que necesitan resolución para consultas ya en curso. Esta vulnerabilidad requiere que Unbound sea compilado con soporte DoQ (’--with-libngtcp2’) y que el ’quic-port’ sea configurado para las interfaces de escucha. Además, un actor malicioso necesita acceso a múltiples IPs de origen para eludir la opción ’wait-limit’ configurada por defecto."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NLnet Labs",
          "product": "Unbound",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.22.0",
              "lessThan": "1.25.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T14:29:10.891526Z",
          "id": "CVE-2026-41637",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-772"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.22.0",
              "versionEndExcluding": "1.25.2",
              "matchCriteriaId": "0C48102E-1D81-4A87-898D-F1CE83C78D26"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41637.txt",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}