Описание
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Unbound exceed the configured 'quic-size' limit with low-cost input. Using only one connection and two streams, each sending a declared 65535-byte length prefix and then holding the streams open, a client can already trivially make Unbound roughly allocate double that amount. This is a remote availability issue / memory-accounting bypass in the downstream DoQ implementation that leads to denial of service for new DoQ clients. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
A flaw was found in Unbound when DNS-over-QUIC (DoQ) is enabled. An attacker could exploit improper validation of client-provided data length, leading to excessive memory allocation. This can cause the system to exceed its configured memory limits for QUIC connections, resulting in a Denial of Service (DoS) for new DoQ clients.
Отчет
This Important flaw in Unbound, when configured for DNS-over-QUIC (DoQ), can lead to a denial of service for new DoQ clients. An attacker can exploit improper validation of client-provided data length, causing excessive memory allocation and exceeding configured limits. This impacts the availability of the DNS resolver for DoQ connections.
Меры по смягчению последствий
To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in unbound.conf. For example, remove or comment out lines such as do-quic: yes or quic-port: 853.
After modifying the configuration, restart the Unbound service for the changes to take effect:
Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | unbound | Not affected | ||
| Red Hat Enterprise Linux 6 | unbound | Not affected | ||
| Red Hat Enterprise Linux 7 | unbound | Not affected | ||
| Red Hat Enterprise Linux 8 | unbound | Not affected | ||
| Red Hat Enterprise Linux 9 | unbound | Not affected | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Affected | ||
| Red Hat Hardened Images | unbound-main-1.25.2-0.1.hum1 | Fixed | RHSA-2026:43588 | 22.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Unbound exceed the configured 'quic-size' limit with low-cost input. Using only one connection and two streams, each sending a declared 65535-byte length prefix and then holding the streams open, a client can already trivially make Unbound roughly allocate double that amount. This is a remote availability issue / memory-accounting bypass in the downstream DoQ implementation that leads to denial of service for new DoQ clients. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Unbound exceed the configured 'quic-size' limit with low-cost input. Using only one connection and two streams, each sending a declared 65535-byte length prefix and then holding the streams open, a client can already trivially make Unbound roughly allocate double that amount. This is a remote availability issue / memory-accounting bypass in the downstream DoQ implementation that leads to denial of service for new DoQ clients. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstre ...
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Unbound exceed the configured 'quic-size' limit with low-cost input. Using only one connection and two streams, each sending a declared 65535-byte length prefix and then holding the streams open, a client can already trivially make Unbound roughly allocate double that amount. This is a remote availability issue / memory-accounting bypass in the downstream DoQ implementation that leads to denial of service for new DoQ clients. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
EPSS
7.5 High
CVSS3