Unbound DNS Resolver CVE-2026-41637

Two non-default configuration conditions must both be true for exploitation to be possible: Unbound must have been compiled with DNS-over-QUIC support (the '--with-libngtcp2' compile-time flag) and the 'quic-port' directive must be set in unbound.conf to enable a DoQ listening interface. Standard Unbound packages compiled without DoQ and deployments lacking 'quic-port' configuration are entirely unaffected regardless of version. Even when these conditions are met, the attacker must additionally control or spoof multiple source IP addresses to overcome the by-default-enabled 'wait-limit' option, which rate-limits the number of waiting queries per source. Impact is further limited to in-flight queries (names currently being resolved upstream by Unbound) - cached responses and queries for already-resolved names are not affected. The CVSS PR:N and UI:N metrics confirm no authentication or user interaction is needed once the above deployment conditions are present.

The vendor-assigned CVSS 3.1 score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately reflects the limited real-world impact. Attack Complexity is correctly rated High (AC:H) because exploitation requires the attacker to control or spoof multiple source IP addresses to bypass Unbound's built-in 'wait-limit' rate control, which mitigates single-source abuse. Availability impact is Low (A:L) because the effect is selective degradation - only new clients querying in-flight names are affected, not a complete resolver outage. There is no confidentiality or integrity impact. No EPSS score is available in the provided data, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept code has been reported. The most significant real-world limiting factor is that DoQ support is a non-default compile-time and runtime option; the vast majority of Unbound deployments will not be vulnerable. For the minority of deployments that have DoQ enabled, this is a meaningful denial-of-service risk for the DoQ listener, but the impact does not extend to other DNS transport modes (UDP, TCP, DoT).

An attacker controlling a botnet or a diverse set of source IP addresses (to bypass the per-source 'wait-limit' rate control) sends rapid DoQ queries to a targeted Unbound resolver for domain names that trigger active upstream recursive resolution. Each query is immediately cancelled via a QUIC STOP_SENDING or RESET_STREAM frame before a response is delivered, causing Unbound to leak a wait-reply slot per cancelled query. After sustaining this pattern across enough source IPs and query iterations, the wait-reply counter reaches its maximum, and legitimate clients querying the same in-flight domain names receive silent drops with no error response from the resolver.