Description
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without ever reading the stream.
Published: 2026-07-22
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unbound versions 1.22.0 through 1.25.1 contain an assertion fault in the libngtcp2 library that can be triggered by a remote, unauthenticated DNS‑over‑QUIC client. By advertising a very small maximum stream data value and sending a single query, the client forces libngtcp2 to mis‑convert a negative error code into an unsigned 64‑bit value, which then overflows a QUIC variable‑length integer during connection‑close serialization. The resulting assertion aborts the entire Unbound process, effectively denying service to all clients that rely on it. The vulnerability stems from integer overflow and signed-to-unsigned conversion errors (CWE‑190, CWE‑195).

Affected Systems

The vulnerability affects NLnet Labs Unbound DNS servers released from 1.22.0 through 1.25.1. Systems running any of those versions are at risk unless the software has been updated to 1.25.2 or later, or DoQ support has been disabled.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1 % and absence from CISA KEV suggest limited current exploitation. The attack is straightforward: a remote client with network access to the server can open a QUIC connection with the required transport parameters and send a single DNS query to trigger the crash. The method is deterministic and does not require authentication, making it a low‑threshold denial‑of‑service attack.

Generated by OpenCVE AI on August 4, 2026 at 15:44 UTC.

Remediation

Vendor Solution

This issue is fixed starting with version 1.25.2

OpenCVE Recommended Actions

  • Upgrade Unbound to version 1.25.2 or later to remove the libngtcp2 assertion fault.
  • If an upgrade cannot be performed immediately, temporarily disable DNS‑over‑QUIC support in the Unbound configuration.
  • Restrict inbound QUIC traffic with firewall rules to limit exposure from untrusted networks.

Generated by OpenCVE AI on August 4, 2026 at 15:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Nlnetlabs
Nlnetlabs unbound
Vendors & Products Nlnetlabs
Nlnetlabs unbound

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-190
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 22 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Description In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without ever reading the stream.
Title Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
Weaknesses CWE-195
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nlnetlabs Unbound
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-07-22T14:03:20.789Z

Reserved: 2026-06-22T10:11:10.505Z

Link: CVE-2026-55991

cve-icon Vulnrichment

Updated: 2026-07-22T14:03:16.153Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T14:17:21.957

Modified: 2026-07-24T14:25:18.750

Link: CVE-2026-55991

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-22T13:10:13Z

Links: CVE-2026-55991 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T15:45:03Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound

  • CWE-195

    Signed to Unsigned Conversion Error