Low [CVE-2026-41637] Denial of Service via terminated DNS-over-QUIC queries
This low-severity Red Hat Linux advisory covers CVE-2026-41637 affecting Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Red Hat Linux RHEL & SELinux publishes the next one.
See Red Hat Linux RHEL & SELinux's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries.
A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames.
This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option.
A flaw was found in Unbound, a Domain Name System (DNS) resolver. This vulnerability is rated as Low impact.
Unbound, as distributed in Red Hat products, is not typically configured with DNS-over-QUIC (DoQ) support enabled by default. Exploitation requires Unbound to be explicitly compiled with `--with-libngtcp2` and have `quic-port` configured, in addition to an attacker bypassing default rate limits with multiple source IPs.
This makes successful exploitation difficult in standard Red Hat deployments.
- 1.22.0
- 1.25.1
Official advisory · high-confidence parse· fetched 1 day ago·verify at source
- unbound-main-1.25.2-0.1.hum1
- RHSA-2026:43588
Official advisory · high-confidence parse· fetched 1 day ago·verify at source
Mitigation checklist
- To mitigate this issue, completely disable DNS-over-QUIC (DoQ) support by removing or commenting out the quic-port directive in your Unbound configuration. Restart the Unbound service to apply the changes and clear any lingering resource limits.
Official advisory · high-confidence parse· fetched 1 day ago·verify at source
More Red Hat Linux advisories
- CVE-2026-111497Oct 22, 2026Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-109619Oct 21, 2026fatal error handling retains stale request state leading to use-after-free
- CVE-2026-109618Oct 21, 2026OOM bailout during request parsing leads to memory corruption and RCE
- CVE-2026-119977Oct 31, 2026Arbitrary code execution via predictable upgrade staging paths
- CVE-2026-97229Oct 13, 2026integer overflow issue in CI/CD regular expression compiler
- CVE-2026-64849Aug 17, 2026Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed
iPhone and Android apps · New on the App Store
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.