Memory accounting bypass in Unbound downstream DoQ implementation (CVE-2026-32665)

In NLnet Labs Unbound versions 1.22.0 through 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection bypass the per-stream 'quic-size' gate, allowing a remote client to exceed the configured memory limit with low-cost input. This leads to excessive memory allocation and denial of service for new DoQ clients. Affected versions: - 1.22.0 - 1.25.1 We recommend updating to: 1.25.2. CVSS 7.5 · our assessment: this_week Reference: https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-32665.txt Details: https://vuln.today/cve/CVE-2026-32665