In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Unbound exceed the configured 'quic-size' limit with low-cost input. Using only one connection and two streams, each sending a declared 65535-byte length prefix and then holding the streams open, a client can already trivially make Unbound roughly allocate double that amount. This is a remote availability issue / memory-accounting bypass in the downstream DoQ implementation that leads to denial of service for new DoQ clients. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
Casky was already ahead
This CVE exploits attack patterns that Casky's 327matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
NLnet Labs Unbound versions 1.22.0 through 1.25.1 contain a critical flaw in DNS-over-QUIC (DoQ) stream handling that allows remote attackers to exhaust server memory. The vulnerability exploits a logic error where the first two bidirectional streams (stream IDs 0 and 4) on a new QUIC connection skip the configured 'quic-size' buffer limit enforcement. An attacker can send large DNS queries with minimal overhead, causing the resolver to allocate memory beyond its configured threshold. Organizations running affected Unbound versions as recursive resolvers or with DoQ enabled face denial-of-service risks, as malicious clients require only a single connection and two streams to trigger memory exhaustion.
Casky's 754 security skills mapped to MITRE ATT&CK enable detection of the exploitation patterns underlying this vulnerability. The attack aligns with TA0040 (Impact) techniques like resource exhaustion and TA0011 (Command and Control) DNS protocol abuse. Practitioners using Casky would observe findings related to CWE-1284 (improper validation of specified quantity in input), detecting anomalous memory allocation patterns following QUIC stream initialization, unusual DNS query sizes on stream IDs 0 and 4, and buffer consumption exceeding configured limits. Extended reasoning across mapped skills would correlate stream-level packet analysis with resolver resource metrics, enabling security teams to identify exploitation attempts before memory exhaustion occurs and distinguish malicious DoQ traffic from legitimate DNS queries.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-32665.
Casky has 327 skills that investigate the attack patterns behind CVE-2026-32665. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →Account Takeover
red teaming · high
Account Takeover
incident response · low
Account Takeover: Exposed Login Credential
red teaming · high
Account Takeover: Exposed Login Credential
soc operations · low
Account Takeover: Exposed Login Credential
incident response · low
Account Takeover: Exposed Login Credential
threat hunting · low
Adversary-in-the-Browser: Malicious JavaScript Injection
network security · medium
analyzing-android-malware-with-apktool
malware analysis · medium
analyzing-apt-group-with-mitre-navigator
threat intelligence · low
analyzing-bootkit-and-rootkit-samples
malware analysis · medium
analyzing-campaign-attribution-evidence
threat intelligence · low
analyzing-cobalt-strike-beacon-configuration
malware analysis · medium
analyzing-cobaltstrike-malleable-c2-profiles
malware analysis · medium
analyzing-command-and-control-communication
malware analysis · medium
analyzing-cyber-kill-chain
threat intelligence · low
analyzing-dns-logs-for-exfiltration
soc operations · low
analyzing-golang-malware-with-ghidra
malware analysis · medium
analyzing-heap-spray-exploitation
malware analysis · medium
analyzing-linux-audit-logs-for-intrusion
incident response · low
analyzing-macro-malware-in-office-documents
malware analysis · medium
analyzing-malicious-pdf-with-peepdf
malware analysis · medium
analyzing-malware-behavior-with-cuckoo-sandbox
malware analysis · medium
analyzing-malware-family-relationships-with-malpedia
threat intelligence · low
analyzing-malware-persistence-with-autoruns
malware analysis · medium
analyzing-malware-sandbox-evasion-techniques
malware analysis · medium
analyzing-memory-dumps-with-volatility
malware analysis · medium
analyzing-network-covert-channels-in-malware
malware analysis · medium
analyzing-network-flow-data-with-netflow
network security · medium
analyzing-network-packets-with-scapy
network security · medium
analyzing-network-traffic-for-incidents
incident response · low
analyzing-network-traffic-of-malware
malware analysis · medium
analyzing-network-traffic-with-wireshark
network security · medium
analyzing-packed-malware-with-upx-unpacker
malware analysis · medium
analyzing-pdf-malware-with-pdfid
malware analysis · medium
analyzing-persistence-mechanisms-in-linux
threat hunting · low
analyzing-powershell-empire-artifacts
threat hunting · low
analyzing-security-logs-with-splunk
incident response · low
analyzing-supply-chain-malware-artifacts
malware analysis · medium
analyzing-threat-actor-ttps-with-mitre-attack
threat intelligence · low
analyzing-threat-actor-ttps-with-mitre-navigator
threat intelligence · low
analyzing-threat-intelligence-feeds
threat intelligence · low
analyzing-threat-landscape-with-misp
threat intelligence · low
analyzing-windows-event-logs-in-splunk
soc operations · low
auditing-tls-certificate-transparency-logs
threat intelligence · low
automating-ioc-enrichment
threat intelligence · low
Brute Force: Credential Stuffing
threat intelligence · low
building-adversary-infrastructure-tracking-system
threat intelligence · low
building-attack-pattern-library-from-cti-reports
threat intelligence · low
building-automated-malware-submission-pipeline
soc operations · low
building-c2-infrastructure-with-sliver-framework
red teaming · high
building-c2-redirector-infrastructure
red teaming · high
building-detection-rule-with-splunk-spl
soc operations · low
building-detection-rules-with-sigma
soc operations · low
building-incident-response-dashboard
soc operations · low
building-incident-response-playbook
incident response · low
building-incident-timeline-with-timesketch
incident response · low
building-ioc-defanging-and-sharing-pipeline
threat intelligence · low
building-ioc-enrichment-pipeline-with-opencti
threat intelligence · low
building-malware-incident-communication-template
incident response · low
building-red-team-c2-infrastructure-with-havoc
red teaming · high
building-soc-escalation-matrix
soc operations · low
building-soc-metrics-and-kpi-tracking
soc operations · low
building-threat-actor-profile-from-osint
threat intelligence · low
building-threat-feed-aggregation-with-misp
threat intelligence · low
building-threat-hunt-hypothesis-framework
threat hunting · low
building-threat-intelligence-enrichment-in-splunk
soc operations · low
building-threat-intelligence-feed-integration
soc operations · low
building-threat-intelligence-platform
threat intelligence · low
building-vulnerability-scanning-workflow
soc operations · low
coercing-authentication-with-coercer-petitpotam
red teaming · high
collecting-indicators-of-compromise
incident response · low
collecting-open-source-intelligence
threat intelligence · low
collecting-threat-intelligence-with-misp
threat intelligence · low
collecting-volatile-evidence-from-compromised-host
incident response · low
conducting-cloud-incident-response
incident response · low
conducting-domain-persistence-with-dcsync
red teaming · high
conducting-full-scope-red-team-engagement
red teaming · high
conducting-internal-reconnaissance-with-bloodhound-ce
red teaming · high
conducting-malware-incident-response
incident response · low
conducting-man-in-the-middle-attack-simulation
network security · medium
conducting-memory-forensics-with-volatility
incident response · low
conducting-pass-the-ticket-attack
red teaming · high
conducting-post-incident-lessons-learned
incident response · low
configuring-network-segmentation-with-vlans
network security · medium
configuring-pfsense-firewall-rules
network security · medium
configuring-snort-ids-for-intrusion-detection
network security · medium
configuring-suricata-for-network-monitoring
network security · medium
containing-active-breach
incident response · low
Conversion to Physical Monetary Instruments: Cash
incident response · low
Conversion to Physical Monetary Instruments: Cash
ransomware defense · medium
Conversion to Physical Monetary Instruments: Cash
ransomware defense · medium
Conversion to Physical Monetary Instruments: Cash
incident response · low
Convert to Cryptocurrency
ransomware defense · medium
Convert to Cryptocurrency
ransomware defense · medium
correlating-security-events-in-qradar
soc operations · low
correlating-threat-campaigns
threat intelligence · low
Create Fake Materials: Fake Website
threat intelligence · low
Create Fake Materials: Fake Website
threat hunting · low
deobfuscating-javascript-malware
malware analysis · medium
deobfuscating-powershell-obfuscated-malware
malware analysis · medium
detecting-anomalies-in-industrial-control-systems
ot ics security · medium
detecting-arp-poisoning-in-network-traffic
network security · medium
detecting-attacks-on-historian-servers
ot ics security · medium
detecting-attacks-on-scada-systems
ot ics security · medium
detecting-command-and-control-over-dns
network security · medium
detecting-dcsync-attack-in-active-directory
threat hunting · low
detecting-dll-sideloading-attacks
threat hunting · low
detecting-dnp3-protocol-anomalies
ot ics security · medium
detecting-dns-exfiltration-with-dns-query-analysis
network security · medium
detecting-email-account-compromise
incident response · low
detecting-email-forwarding-rules-attack
threat hunting · low
detecting-entra-offensive-tools-in-graph-logs
soc operations · low
detecting-exfiltration-over-dns-with-zeek
network security · medium
detecting-fileless-malware-techniques
malware analysis · medium
detecting-golden-ticket-attacks-in-kerberos-logs
threat hunting · low
detecting-insider-threat-behaviors
threat hunting · low
detecting-kerberoasting-attacks
threat hunting · low
detecting-lateral-movement-in-network
network security · medium
detecting-lateral-movement-with-splunk
threat hunting · low
detecting-lateral-movement-with-zeek
network security · medium
detecting-malicious-scheduled-tasks-with-sysmon
threat hunting · low
detecting-mimikatz-execution-patterns
threat hunting · low
detecting-modbus-command-injection-attacks
ot ics security · medium
detecting-modbus-protocol-anomalies
ot ics security · medium
detecting-network-anomalies-with-zeek
network security · medium
detecting-network-scanning-with-ids-signatures
network security · medium
detecting-ntlm-relay-with-event-correlation
threat hunting · low
detecting-pass-the-hash-attacks
threat hunting · low
detecting-port-scanning-with-fail2ban
network security · medium
detecting-privilege-escalation-attempts
threat hunting · low
detecting-process-hollowing-technique
threat hunting · low
detecting-process-injection-techniques
malware analysis · medium
detecting-rootkit-activity
malware analysis · medium
detecting-service-account-abuse
threat hunting · low
detecting-stuxnet-style-attacks
ot ics security · medium
detecting-suspicious-powershell-execution
threat hunting · low
detecting-t1055-process-injection-with-sysmon
threat hunting · low
detecting-t1548-abuse-elevation-control-mechanism
threat hunting · low
detecting-wmi-persistence
threat hunting · low
Electronic Funds Transfer: Wire Transfer
threat intelligence · low
Electronic Funds Transfer: Wire Transfer
ransomware defense · medium
Email Spoofing
threat intelligence · low
eradicating-malware-from-infected-systems
incident response · low
evaluating-threat-intelligence-platforms
threat intelligence · low
executing-red-team-engagement-planning
red teaming · high
exploiting-active-directory-certificate-services-esc1
red teaming · high
exploiting-active-directory-with-bloodhound
red teaming · high
exploiting-adcs-with-certipy
red teaming · high
exploiting-bgp-hijacking-vulnerabilities
network security · medium
exploiting-constrained-delegation-abuse
red teaming · high
exploiting-ipv6-vulnerabilities
network security · medium
exploiting-kerberoasting-with-impacket
red teaming · high
exploiting-ms17-010-eternalblue-vulnerability
red teaming · high
exploiting-nopac-cve-2021-42278-42287
red teaming · high
exploiting-smb-vulnerabilities-with-metasploit
network security · medium
exploiting-zerologon-vulnerability-cve-2020-1472
red teaming · high
extracting-config-from-agent-tesla-rat
malware analysis · medium
extracting-iocs-from-malware-samples
malware analysis · medium
fleet-hunting-with-velociraptor
threat hunting · low
Gather Customer Information
threat intelligence · low
generating-threat-intelligence-reports
threat intelligence · low
hunting-advanced-persistent-threats
threat intelligence · low
hunting-evtx-with-chainsaw
threat hunting · low
hunting-for-anomalous-powershell-execution
threat hunting · low
hunting-for-beaconing-with-frequency-analysis
threat hunting · low
hunting-for-cobalt-strike-beacons
threat hunting · low
hunting-for-command-and-control-beaconing
threat hunting · low
hunting-for-data-exfiltration-indicators
threat hunting · low
hunting-for-data-staging-before-exfiltration
threat hunting · low
hunting-for-dcom-lateral-movement
threat hunting · low
hunting-for-dcsync-attacks
threat hunting · low
hunting-for-defense-evasion-via-timestomping
threat hunting · low
hunting-for-dns-based-persistence
threat hunting · low
hunting-for-dns-tunneling-with-zeek
threat hunting · low
hunting-for-domain-fronting-c2-traffic
threat hunting · low
hunting-for-lateral-movement-via-wmi
threat hunting · low
hunting-for-living-off-the-cloud-techniques
threat hunting · low
hunting-for-living-off-the-land-binaries
threat hunting · low
hunting-for-lolbins-execution-in-endpoint-logs
threat hunting · low
hunting-for-ntlm-relay-attacks
threat hunting · low
hunting-for-persistence-mechanisms-in-windows
threat hunting · low
hunting-for-persistence-via-wmi-subscriptions
threat hunting · low
hunting-for-process-injection-techniques
threat hunting · low
hunting-for-registry-persistence-mechanisms
threat hunting · low
hunting-for-registry-run-key-persistence
threat hunting · low
hunting-for-scheduled-task-persistence
threat hunting · low
hunting-for-shadow-copy-deletion
threat hunting · low
hunting-for-startup-folder-persistence
threat hunting · low
hunting-for-supply-chain-compromise
threat hunting · low
hunting-for-suspicious-scheduled-tasks
threat hunting · low
hunting-for-t1098-account-manipulation
threat hunting · low
hunting-for-unusual-network-connections
threat hunting · low
hunting-for-unusual-service-installations
threat hunting · low
hunting-for-webshell-activity
threat hunting · low
hunting-saas-sso-token-abuse
soc operations · low
implementing-alert-fatigue-reduction
soc operations · low
implementing-bgp-security-with-rpki
network security · medium
implementing-conduit-security-for-ot-remote-access
ot ics security · medium
implementing-ddos-mitigation-with-cloudflare
network security · medium
implementing-diamond-model-analysis
threat intelligence · low
implementing-dragos-platform-for-ot-monitoring
ot ics security · medium
implementing-ics-firewall-with-tofino
ot ics security · medium
implementing-iec-62443-security-zones
ot ics security · medium
implementing-immutable-backup-with-restic
ransomware defense · medium
implementing-mitre-attack-coverage-mapping
soc operations · low
implementing-nerc-cip-compliance-controls
ot ics security · medium
implementing-network-access-control
network security · medium
implementing-network-access-control-with-cisco-ise
network security · medium
implementing-network-intrusion-prevention-with-suricata
network security · medium
implementing-network-segmentation-for-ot
ot ics security · medium
implementing-network-segmentation-with-firewall-zones
network security · medium
implementing-network-traffic-analysis-with-arkime
network security · medium
implementing-network-traffic-baselining
network security · medium
implementing-next-generation-firewall-with-palo-alto
network security · medium
implementing-ot-incident-response-playbook
ot ics security · medium
implementing-ot-network-traffic-analysis-with-nozomi
ot ics security · medium
implementing-patch-management-for-ot-systems
ot ics security · medium
implementing-purdue-model-network-segmentation
ot ics security · medium
implementing-security-information-sharing-with-stix2
threat intelligence · low
implementing-siem-use-cases-for-detection
soc operations · low
implementing-soar-automation-with-phantom
soc operations · low
implementing-soar-playbook-with-palo-alto-xsoar
soc operations · low
implementing-stix-taxii-feed-integration
threat intelligence · low
implementing-taxii-server-with-opentaxii
threat intelligence · low
implementing-threat-intelligence-lifecycle-management
threat intelligence · low
implementing-threat-modeling-with-mitre-attack
soc operations · low
implementing-ticketing-system-for-incidents
soc operations · low
implementing-velociraptor-for-ir-collection
incident response · low
Indicator Removal
ransomware defense · medium
Indicator Removal
ransomware defense · medium
Insider Access Abuse
ransomware defense · medium
investigating-insider-threat-indicators
soc operations · low
managing-intelligence-lifecycle
threat intelligence · low
mapping-attack-paths-with-bloodhound-ce
red teaming · high
mapping-mitre-attack-techniques
threat intelligence · low
modeling-threats-with-opencti
threat intelligence · low
operating-havoc-c2
red teaming · high
operating-sliver-c2
red teaming · high
operationalizing-misp-threat-feeds
threat intelligence · low
performing-active-directory-bloodhound-analysis
red teaming · high
performing-active-directory-compromise-investigation
incident response · low
performing-ai-driven-osint-correlation
threat intelligence · low
performing-alert-triage-with-elastic-siem
soc operations · low
performing-arp-spoofing-attack-simulation
network security · medium
performing-automated-malware-analysis-with-cape
malware analysis · medium
performing-bandwidth-throttling-attack-simulation
network security · medium
performing-cloud-incident-containment-procedures
incident response · low
performing-dark-web-monitoring-for-threats
threat intelligence · low
performing-deception-technology-deployment
soc operations · low
performing-disk-forensics-investigation
incident response · low
performing-dns-enumeration-and-zone-transfer
network security · medium
performing-dynamic-analysis-with-any-run
malware analysis · medium
performing-false-positive-reduction-in-siem
soc operations · low
performing-firmware-malware-analysis
malware analysis · medium
performing-ics-asset-discovery-with-claroty
ot ics security · medium
performing-indicator-lifecycle-management
threat intelligence · low
performing-insider-threat-investigation
incident response · low
performing-ioc-enrichment-automation
soc operations · low
performing-ip-reputation-analysis-with-shodan
threat intelligence · low
performing-kerberoasting-attack
red teaming · high
performing-lateral-movement-detection
soc operations · low
performing-lateral-movement-with-wmiexec
red teaming · high
performing-log-source-onboarding-in-siem
soc operations · low
performing-malware-hash-enrichment-with-virustotal
threat intelligence · low
performing-malware-ioc-extraction
threat intelligence · low
performing-malware-triage-with-yara
malware analysis · medium
performing-memory-forensics-with-volatility3-plugins
malware analysis · medium
performing-network-traffic-analysis-with-tshark
network security · medium
performing-network-traffic-analysis-with-zeek
network security · medium
performing-oil-gas-cybersecurity-assessment
ot ics security · medium
performing-open-source-intelligence-gathering
red teaming · high
performing-osint-with-spiderfoot
threat intelligence · low
performing-ot-network-security-assessment
ot ics security · medium
performing-ot-vulnerability-assessment-with-claroty
ot ics security · medium
performing-ot-vulnerability-scanning-safely
ot ics security · medium
performing-packet-injection-attack
network security · medium
performing-physical-intrusion-assessment
red teaming · high
performing-plc-firmware-security-analysis
ot ics security · medium
performing-power-grid-cybersecurity-assessment
ot ics security · medium
performing-privilege-escalation-on-linux
red teaming · high
performing-purple-team-exercise
soc operations · low
performing-s7comm-protocol-security-analysis
ot ics security · medium
performing-scada-hmi-security-assessment
ot ics security · medium
performing-soc-tabletop-exercise
soc operations · low
performing-ssl-stripping-attack
network security · medium
performing-ssl-tls-inspection-configuration
network security · medium
performing-ssl-tls-security-assessment
network security · medium
performing-static-malware-analysis-with-pe-studio
malware analysis · medium
performing-threat-emulation-with-atomic-red-team
threat intelligence · low
performing-threat-hunting-with-elastic-siem
soc operations · low
performing-threat-hunting-with-yara-rules
threat hunting · low
performing-threat-intelligence-sharing-with-misp
threat intelligence · low
performing-threat-landscape-assessment-for-sector
threat intelligence · low
performing-user-behavior-analytics
soc operations · low
performing-vlan-hopping-attack
network security · medium
performing-wifi-password-cracking-with-aircrack
network security · medium
performing-wireless-security-assessment-with-kismet
network security · medium
performing-yara-rule-development-for-detection
malware analysis · medium
Phishing
threat intelligence · low
Phishing
threat intelligence · low
Phone Number Spoofing: Official Phone Number Spoofing
red teaming · high
processing-stix-taxii-feeds
threat intelligence · low
profiling-threat-actor-groups
threat intelligence · low
relaying-ntlm-for-adcs-esc8
red teaming · high
Remote Access Tools
malware analysis · medium
Remote Access Tools
malware analysis · medium
Remote Access Tools
ransomware defense · medium
reverse-engineering-android-malware-with-jadx
malware analysis · medium
reverse-engineering-dotnet-malware-with-dnspy
malware analysis · medium
reverse-engineering-malware-with-ghidra
malware analysis · medium
reverse-engineering-rust-malware
malware analysis · medium
scanning-network-with-nmap-advanced
network security · medium
securing-historian-server-in-ot-environment
ot ics security · medium
securing-remote-access-to-ot-environment
ot ics security · medium
Stage Capabilities: SEO Poisoning
threat intelligence · low
Structuring
ransomware defense · medium
Transfer of funds
threat hunting · low
Transfer of funds
soc operations · low
Transfer of funds
ransomware defense · medium
Transfer of funds
malware analysis · medium
Transfer of funds
ransomware defense · medium
triaging-security-alerts-in-splunk
soc operations · low
triaging-security-incident
incident response · low
triaging-security-incident-with-ir-playbook
incident response · low
© 2026 Casky.AI, Inc. · AI Security Investigation