CVE-2026-32665
HIGH 7.5 ALL-YEARSIn NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Unbound exceed the configured 'quic-size' limit with low-cost input. Using only one connection and two streams, each sending a declared 65535-byte length prefix and then holding the streams open, a client can already trivially make Unbound roughly allocate double that amount. This is a remote availability issue / memory-accounting bypass in the downstream DoQ implementation that leads to denial of service for new DoQ clients. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
Severe if exploited (CVSS 7.5), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 21st percentile
Impact if exploited
7.5CVSS 3.1 · HIGH · CNA
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-1284: : Improper Validation of Specified Quantity in Input
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 48 vendor product statements; 16 omitted. Read the full vendor advisory.
python3-unbound-0:1.25.2-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
python3-unbound-0:1.25.2-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-0:1.25.2-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-0:1.25.2-0.1.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-0:1.25.2-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-anchor-0:1.25.2-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-anchor-0:1.25.2-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-devel-0:1.25.2-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-dracut-0:1.25.2-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-dracut-0:1.25.2-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-libs-0:1.25.2-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-libs-0:1.25.2-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-munin-0:1.25.2-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-munin-0:1.25.2-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-utils-0:1.25.2-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
unbound-utils-0:1.25.2-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`. After modifying the configuration, restart the Unbound service for the changes to take effect: ```bash systemctl restart unbound ``` Warning: Restarting the Unbound service will temporarily interrupt DNS resolution.
python3-unbound as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/python3-unbound
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound-anchor as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-anchor
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound-dracut as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-dracut
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound-utils as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-utils
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound-libs as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-libs
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound.src as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound?arch=src
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-devel
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound-python as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-python
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00python3-unbound as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/python3-unbound
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-devel
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound.src as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound?arch=src
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound-dracut as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-dracut
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00unbound.src as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound?arch=src
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not in execute path
pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9
Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Nlnetlabs | Unbound | ≥ 1.22.0 and < 1.25.2 |
All CVSS metrics
- HIGH 7.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - HIGH 7.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Advisories
- https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-32665.txt CVE record · NLnet Labs · Updated 2026-09-16T14:24:37.708Z
NVD · CVE-2026-32665 · Updated 2026-10-24T13:10:00.147 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32665.json Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47663 EUVD · EUVD-2026-47663
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-32665 Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2503060 Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-32665 Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-32665 Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00
- https://access.redhat.com/errata/RHSA-2026:43588 Red Hat · CVE-2026-32665 · Updated 2026-10-23T17:23:49+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS