CVE-2026-32665 describes an improper validation of specified quantity in input in NLnet Labs Unbound when downstream DNS-over-QUIC (DoQ) is enabled. The first two bidirectional streams (stream_id 0 and 4) on a new QUIC connection bypass the per-stream 'quic-size' gate, allowing large input buffers to be allocated after only receiving a 2-byte length prefix. A remote client can exploit this by sending streams with a declared 65535-byte length prefix and holding them open, causing Unbound to allocate roughly double that amount of memory. This memory-accounting bypass leads to denial of service for new DoQ clients. The vulnerability affects Unbound versions from 1.22.0 through 1.25.1 and requires DoQ support to be compiled and configured.

The vulnerability allows a remote unauthenticated attacker to cause excessive memory allocation on the Unbound server by bypassing input size limits on initial QUIC streams. This results in a denial of service condition, preventing new downstream DoQ clients from connecting. There is no impact on confidentiality or integrity reported. The CVSS 3.1 base score is 7.5 (High) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling downstream DNS-over-QUIC (DoQ) support or avoid enabling the 'quic-port' configuration to prevent exposure. Monitor NLnet Labs advisories for updates and apply official patches once available.