CyberRota Analysis
AI-GeneratedUnbound versions 1.22.0 through 1.25.1 are vulnerable to a denial-of-service condition due to improper handling of terminated DNS-over-QUIC queries, which can lead to an inflated number of waiting replies and degraded service for new clients. Attackers can exploit this by sending multiple DoQ queries from different IPs and immediately terminating them, potentially causing silent drops of legitimate queries once the system's limits are reached. Organizations using Unbound with DoQ support enabled should prioritize addressing this vulnerability to maintain DNS resolution reliability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.
Related CVEs
Other vulnerabilities affecting the same vendor(s)