VULNERABILITY INTELLIGENCE

CVE-2026-32665

CVSS score7.5 HIGH

EPSS probability0.39%

CISA KEVNot currently listed

Published2026-07-22

Last modified2026-10-24

Description

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byt…