What is the CVSS score of CVE-2026-41637?

CVE-2026-41637 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-41637?

Yes, a patch is available for CVE-2026-41637. Update the affected software to the latest version immediately.

Unbound DNS Resolver CVE-2026-41637

EUVD-2026-47665 LOW

Missing Release of Resource after Effective Lifetime (CWE-772)

2026-07-22 NLnet Labs

GHSA-6cj4-j994-m7pr

Authentication Bypass Unbound

3.7

CVSS 3.1 · Vendor: NLnet Labs

Severity by source

Vendor (NLnet Labs) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.7 LOW

AC:H reflects mandatory multi-source-IP bypass of wait-limit; A:L for selective degradation only; C/I:N as no data exposure or modification occurs.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 13:49 vuln.today

DescriptionCVE.org

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.

AnalysisAI

Resolution service degradation in NLnet Labs Unbound 1.22.0 through 1.25.1 enables unauthenticated remote attackers to silently drop DNS responses for new clients by exploiting a resource-accounting flaw in the DNS-over-QUIC (DoQ) subsystem. Attackers send DoQ queries for names that trigger upstream resolution and immediately terminate them using QUIC STOP_SENDING, RESET_STREAM, or CONNECTION_CLOSE frames, causing Unbound's internal wait-reply counter to inflate indefinitely without release. When the counter ceiling is reached, new clients querying the same in-flight names receive no response. No public exploit has been identified at time of analysis; exploitation is constrained by non-default DoQ configuration requirements and the need for multiple source IPs.

Technical ContextAI

Unbound is a validating, recursive DNS resolver developed by NLnet Labs, widely deployed in ISP and enterprise environments. DNS-over-QUIC (DoQ, RFC 9250) is an optional transport layer that must be explicitly compiled in using the '--with-libngtcp2' flag (linking the ngtcp2 QUIC library) and activated via the 'quic-port' configuration directive. The root cause is CWE-772 (Missing Release of Resource after Effective Lifetime): when a QUIC stream or connection carrying a DNS query is terminated early by the client, Unbound fails to properly decrement the counter tracking pending reply slots for in-flight upstream resolution queries. This counter leak allows a low-cost, sustained inflation attack - each terminated DoQ query consumes a slot without ever releasing it. The CPE cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:* confirms all Unbound application builds are potentially in scope, but the DoQ compilation and configuration requirements functionally narrow the exploitable population significantly.

RemediationAI

Operators should consult the official vendor advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41637.txt for the patched release, which is expected to be a version after 1.25.1; a specific fixed version number was not independently confirmed from the available data and should be verified directly with NLnet Labs before upgrading. As an immediately effective compensating control with no impact on other DNS transports, operators can disable DoQ entirely by removing or commenting out the 'quic-port' directive from unbound.conf and restarting the service - this eliminates the attack surface completely while DNS-over-UDP, DNS-over-TCP, and DNS-over-TLS services remain unaffected. For operators who must retain DoQ, reviewing and reducing the 'wait-limit' configuration value will increase the cost of the attack but will not fully mitigate it if the attacker has sufficient source IP diversity. Recompiling Unbound without '--with-libngtcp2' is a definitive mitigation where DoQ is not operationally required.