UBUNTU-CVE-2026-32665

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Unbound exceed the configured 'quic-size' limit with low-cost input. Using only one connection and two streams, each sending a declared 65535-byte length prefix and then holding the streams open, a client can already trivially make Unbound roughly allocate double that amount. This is a remote availability issue / memory-accounting bypass in the downstream DoQ implementation that leads to denial of service for new DoQ clients. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.

References

Affected packages

Ubuntu:26.10 / unbound

Package

Name: unbound
Purl: pkg:deb/ubuntu/unbound?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.24.2-1ubuntu2

1.25.1-1ubuntu1

1.25.1-1ubuntu3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libunbound8",
            "binary_version": "1.25.1-1ubuntu3"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.25.1-1ubuntu3"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.25.1-1ubuntu3"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.25.1-1ubuntu3"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.25.1-1ubuntu3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-32665.json"

Ubuntu:26.04:LTS / unbound

Package

Name: unbound
Purl: pkg:deb/ubuntu/unbound?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.24.2-1ubuntu2.4

Affected versions

1.*

1.22.0-2ubuntu2

1.22.0-2ubuntu4

1.24.2-1ubuntu1

1.24.2-1ubuntu2

1.24.2-1ubuntu2.1

1.24.2-1ubuntu2.2

1.24.2-1ubuntu2.3

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libunbound8",
            "binary_version": "1.24.2-1ubuntu2.4"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.24.2-1ubuntu2.4"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.24.2-1ubuntu2.4"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.24.2-1ubuntu2.4"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.24.2-1ubuntu2.4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-32665.json"