Description
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
Published: 2026-07-22
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A faulty assertion in the libngtcp2 library, used by Unbound for DNS-over-QUIC support, can be triggered when the server experiences high concurrency and pressure. When the library receives a monotonic timestamp that does not match expectations, the assertion fails and forces the server to crash, resulting in a denial of service. The weakness is classified as CWE‑617, indicating an improper handling of assertion failure paths.

Affected Systems

The vulnerability affects NLnet Labs Unbound versions 1.22.0 through 1.25.1. It only manifests when the software is compiled with DoQ support via the '--with-libngtcp2' flag and when the 'quic-port' is configured to listen for QUIC traffic. Any deployment using those build options and versions is potentially impacted.

Risk and Exploitability

The CVSS score of 5.9 marks this as a moderate severity issue, and the EPSS score of < 1% (indicating a very low exploitation probability) suggests limited public exploit evidence. The vulnerability's attack vector is a high‑volume, concurrent DNS-over-QUIC request stream that triggers the assertion, leading to server termination. No public exploits are reported, but the conditions are realistic for an attacker targeting a DoQ‑enabled Unbound deployment.

Generated by OpenCVE AI on August 4, 2026 at 15:45 UTC.

Remediation

Vendor Solution

This issue is fixed starting with version 1.25.2

OpenCVE Recommended Actions

  • Upgrade Unbound to version 1.25.2 or later to receive the fix for the libngtcp2 assertion
  • If DNS-over-QUIC is enabled, disable it by removing or setting to 0 the 'quic-port' configuration so that no QUIC traffic reaches the server
  • Apply traffic shaping or rate limiting to reduce high‑concurrency load on any remaining DoQ endpoints mitigating the trigger conditions for the assertion failure

Generated by OpenCVE AI on August 4, 2026 at 15:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Nlnetlabs
Nlnetlabs unbound
Vendors & Products Nlnetlabs
Nlnetlabs unbound

Sat, 25 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 22 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Description In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
Title Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
Weaknesses CWE-617
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nlnetlabs Unbound
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-07-22T14:33:23.363Z

Reserved: 2026-07-03T11:59:36.383Z

Link: CVE-2026-14586

cve-icon Vulnrichment

Updated: 2026-07-22T14:33:17.415Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-22T14:17:15.020

Modified: 2026-07-22T20:33:11.590

Link: CVE-2026-14586

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-22T13:03:53Z

Links: CVE-2026-14586 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T16:00:12Z

Weaknesses