NLnet Labs Unbound EUVD-2026-47663

Exploitation requires the target Unbound (1.22.0-1.25.1) to be compiled with DoQ support via '--with-libngtcp2' AND to have 'quic-port' configured on a listening interface - downstream DNS-over-QUIC must be actively enabled, which is not the default build or configuration. Given those prerequisites, no authentication, user interaction, or special privilege is needed (PR:N/UI:N): any remote client that can reach the QUIC listener can trigger the bug using one connection and the two initial streams (stream_id 0 and 4) by sending a 65535-byte length prefix and holding the streams open. The limiting factor is entirely the non-default DoQ deployment; builds without ngtcp2 or without a configured quic-port are not exploitable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) accurately reflects a network-reachable, unauthenticated, low-complexity availability-only issue - no confidentiality or integrity impact. The decisive limiter is not on the attack path but on deployment: the target must be a build with DoQ support AND an operator-configured 'quic-port', which is not a default configuration, so the real-world exposed population is a subset of Unbound installs. No EPSS score, KEV entry, POC, or SSVC decision was provided in the input; absence of these signals means exploitation probability cannot be quantified from the data supplied. Weighing these together, this is a genuine but scoped priority: trivial to trigger and low-cost for the attacker where DoQ is enabled, yet gated behind a non-default feature that limits mass exploitability. The impact is degradation/exhaustion affecting new DoQ clients rather than full resolver crash or data compromise.

An attacker reachable to an internet-facing Unbound resolver with DoQ enabled opens a single QUIC connection, creates the two initial bidirectional streams (id 0 and 4), sends a declared 65535-byte length prefix on each, and holds them open without completing the messages. Unbound pre-allocates buffers for the declared sizes outside the 'quic-size' quota, allowing roughly double the configured limit to be allocated from one cheap connection; repeating this exhausts memory and denies service to new DoQ clients. No public exploit code has been identified at time of analysis, though the advisory describes the trigger in full detail.