CVE-2026-32665

A flaw was found in Unbound when DNS-over-QUIC (DoQ) is enabled. An attacker could exploit improper validation of client-provided data length, leading to excessive memory allocation. This can cause the system to exceed its configured memory limits for QUIC connections, resulting in a Denial of Service (DoS) for new DoQ clients.

This Important flaw in Unbound, when configured for DNS-over-QUIC (DoQ), can lead to a denial of service for new DoQ clients. An attacker can exploit improper validation of client-provided data length, causing excessive memory allocation and exceeding configured limits. This impacts the availability of the DNS resolver for DoQ connections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in unbound.conf. For example, remove or comment out lines such as do-quic: yes or quic-port: 853.

After modifying the configuration, restart the Unbound service for the changes to take effect:

systemctl restart unbound

Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.