CVE-2026-32665

Unbound 1.22.0–1.25.1 with downstream DNS-over-QUIC enabled is vulnerable. The first two QUIC streams on a new connection (streams 0 and 4) bypass the per-stream quic-size gate, causing large input buffers to be allocated after only the 2-byte length prefix. A remote attacker can force Unbound to...