In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with… (CVE-2026-55991)

In NLnet Labs Unbound versions 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion failure that terminates the Unbound process. The issue arises from an erroneous error value passed to libngtcp2: when 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound incorrectly calls 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. This '-1' is implicitly converted to the maximum 64-bit unsigned integer (0xFFFFFFFFFFFFFFFF), which exceeds the 62-bit variable-length integer limit in QUIC encoding. Consequently, 'ngtcp2_put_uvarintlen()' fails an assertion, causing the entire resolver process to abort. An attacker can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' and sending one DoQ query without reading the stream.

The vulnerability allows a remote unauthenticated attacker to cause a denial of service by terminating the Unbound DNS resolver process. This results in service disruption until the resolver is restarted. There is no impact on confidentiality or integrity, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling DNS-over-QUIC (DoQ) if possible or compiling Unbound without assertions enabled to avoid process termination. Monitor vendor communications for official patches or updates.