# CVE-2026-41637: Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

CVE-2026-41637 is fixed in unbound on 1 platform, first by DEBIAN-CVE-2026-41637, released July 28, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-41637
- Priority: Routine
- CVSS: 3.7 (Low)
- EPSS: 0.0037
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 22, 2026
- Weakness: Missing Release of Resource after Effective Lifetime
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41637

## Description

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. Those terminated DoQ queries are not properly counted for and keep inflating the number of waiting replies for in-flight queries. When the maximum is reached, it results in silent query drops for new clients needing resolution for already in-flight queries. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | unbound Debian 13.5 (trixie) | 1.26.1-0+deb13u1 | [DEBIAN-CVE-2026-41637](https://patchblox.com/security/data/fix/linux/debian-cve-2026-41637.md) | Jul 28, 2026 |
| Linux | unbound Debian 14 | 1.25.2-1 | [DEBIAN-CVE-2026-41637](https://patchblox.com/security/data/fix/linux/debian-cve-2026-41637.md) | Jul 28, 2026 |
| Linux | unbound opensuse-leap 16.0 | 1.25.2-160000.1.1 | [OPENSUSE-SU-2026:21550-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21550-1.md) | Aug 10, 2026 |
| Linux | unbound sles 16.0 | 1.25.2-160000.1.1 | [SUSE-SU-2026:23226-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23226-1.md) | Aug 10, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.