In NLnet Labs Unbound versions 1.22.0 through 1.25.1, a resource management flaw exists in the handling of client-terminated DNS-over-QUIC queries. Specifically, when clients terminate queries using STOP_SENDING, RESET_STREAM, or CONNECTION_CLOSE QUIC frames, Unbound does not properly decrement the count of waiting replies for those queries. This causes an inflation of the waiting reply count for already in-flight queries, which can lead to silent dropping of new queries once the configured wait-limit is reached. The vulnerability requires Unbound to be built with DoQ support ('--with-libngtcp2') and the quic-port configured. An attacker must also have access to multiple source IP addresses to circumvent the default wait-limit protections.

The vulnerability results in a low-severity denial of service condition where new DNS resolution queries may be silently dropped due to inflated waiting reply counts caused by improperly accounted terminated DoQ queries. There is no impact on confidentiality or integrity. The service degradation affects clients attempting new resolutions when the maximum waiting threshold is reached.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, mitigation requires careful configuration of the 'wait-limit' option and monitoring of DoQ usage. Restricting access to the DoQ service and limiting the ability of attackers to use multiple source IPs may reduce exploitation risk. No official fix or patch has been documented at this time.