CVE-2026-32665— DNS-over-QUIC拒绝服务漏洞因`quic-size`预算绕过
Affected Version Matrix 1
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| NLnet Labs | Unbound | 1.22.0< 1.25.2 | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-32665の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass
ソース: CVE Program / CVE List V5
脆弱性説明
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Unbound exceed the configured 'quic-size' limit with low-cost input. Using only one connection and two streams, each sending a declared 65535-byte length prefix and then holding the streams open, a client can already trivially make Unbound roughly allocate double that amount. This is a remote availability issue / memory-accounting bypass in the downstream DoQ implementation that leads to denial of service for new DoQ clients. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
CWE-1284
ソース: CVE Program / CVE List V5
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| NLnet Labs | Unbound | 1.22.0 ~ 1.25.2 | - |
II. CVE-2026-32665の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-32665のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-32665 厂商安全公告 (1)
Same Patch Batch · NLnet Labs · 2026-07-22 · 24 CVEs total
| CVE-2026-55973 | 7.5 HIGH | 'dns-error-reporting: yes' leads to stack buffer overflow |
| CVE-2026-40691 | 7.5 HIGH | Packet of death for DNSCrypt over TCP |
| CVE-2026-44690 | 7.5 HIGH | Cross-zone wildcard cache poisoning via RRSIG.labels manipulation |
| CVE-2026-50248 | 6.5 MEDIUM | BOGUS configured primary hostname accepted for XFR in auth/rpz zones |
| CVE-2026-52863 | 5.9 MEDIUM | Memory corruption could lead to crash and denial of service |
| CVE-2026-55717 | 5.9 MEDIUM | 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash |
| CVE-2026-55991 | 5.9 MEDIUM | Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 |
| CVE-2026-50046 | 5.9 MEDIUM | Possible heap use-after-free in an error path when a DoT forwarded query is jostled out |
| CVE-2026-55990 | 5.9 MEDIUM | Packet of death for a DNSCrypt misconfigured Unbound |
| CVE-2026-56444 | 5.9 MEDIUM | Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout |
| CVE-2026-44621 | 5.9 MEDIUM | Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abr |
| CVE-2026-14586 | 5.9 MEDIUM | Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments |
| CVE-2026-50251 | 5.3 MEDIUM | Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush |
| CVE-2026-50045 | 5.3 MEDIUM | 'max-global-quota' reset by DNSSEC validation restarts |
| CVE-2026-56416 | 4.8 MEDIUM | Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name |
| CVE-2026-46582 | 3.7 LOW | A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply |
| CVE-2026-44687 | 3.7 LOW | Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legi |
| CVE-2026-41637 | 3.7 LOW | Degradation of resolution service from improperly accounted client-terminated DNS-over-QUI |
| CVE-2026-54478 | 3.7 LOW | DNS Cookie bypass when combined with proxy-protocol use |
| CVE-2026-42955 | 3.7 LOW | Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-tim |
Showing 20 of 24 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Unbound
- CVE-2026-56444
Degradation of resolution service when 'discard-timeout' and - CVE-2026-56416
Possible heap buffer overflow when validator canonicalizes R - CVE-2026-55991
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in - CVE-2026-55990
Packet of death for a DNSCrypt misconfigured Unbound - CVE-2026-55973
'dns-error-reporting: yes' leads to stack buffer overflow
同じベンダー: NLnet Labs
- CVE-2026-56444
Degradation of resolution service when 'discard-timeout' and - CVE-2026-56416
Possible heap buffer overflow when validator canonicalizes R - CVE-2026-55991
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in - CVE-2026-55990
Packet of death for a DNSCrypt misconfigured Unbound - CVE-2026-55973
'dns-error-reporting: yes' leads to stack buffer overflow
同じ弱点: CWE-1284
- CVE-2026-11721
Cache poisoning possible with label count discrepancy, RRSIG - CVE-2026-59252
Missing gas_limit validation in mpp Tempo fee-payer enables - CVE-2026-59694
Unbounded access list in mpp Tempo fee-payer inflates gas co - CVE-2026-59695
Unbounded max_fee_per_gas in mpp Tempo fee-payer enables sin - CVE-2026-57364
WordPress Better Payment – Instant Payments, Donations, Fund
V. CVE-2026-32665へのコメント
まだコメントはありません