Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

When downstream DNS-over-QUIC (DoQ) is enabled, Unbound documents the 'quic-size' configuration option as the maximum number of bytes for all QUIC buffers and data combined, and states that new connections or streams should be refused/reset once the limit is exceeded. However, an improper validation of the client provided length could allow over allocating memory and trivially exceeding the configured budget for future DoQ connections leading to denial of service for new DoQ clients.