Threats Tagged 'cve-2026-55991'

This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879). - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873). - CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875). - CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891). - CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892). - CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly terminated (bsc#1271876). - CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate parent's `NXDOMAIN` (bsc#1271893). - CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877). - CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply path (bsc#1271894). - CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878). - CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882). - CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880). - CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881). - CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883). - CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884). - CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895). - CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896). - CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886). - CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874). - CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887). - CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888). - CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889). - CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are combined in unusual configuration (bsc#1271890). Other updates and bugfixes: - Version 1.25.2: + Features: * TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4 * Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies * Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging * Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch) * Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308) * Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle * Allow ip@port notation in control-interface configuration * Add iter-scrub-rrsig option (default: 8) to limit the number of RRSIGs processed by the scrubber * Add 'tls-protocols' configuration option to select which TLS protocol versions are used; TLSv1.2 is re-enabled by default * Add pthread_setname_np support for named threads + Bug Fixes: * Fix handle leak in pythonmod on pythonmod_init * Fix crash when mesh_detect_cycle_found() is called with no mesh state * Fix modstack_call_init to use the original string when it has changed * Fix fr_atomic_copy_cfg * Fix auth-zone empty label for $ORIGIN when downloading via HTTP * Fix respip and dns64 to be usable simultaneously; RPZ now works with DNS64 * Fix HTTPS and QUIC not being enabled when port is listed in interface-automatic-ports * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits * Fix FIPS mode in OpenSSL causing unit test failure * Fix discard-timeout to only drop UDP, not stream connections * Reply with SERVFAIL when the wait-limit is exceeded * A

NLnet Labs Unbound versions 1.22.0 through 1.25.1 contain a vulnerability where a remote unauthenticated client can cause the Unbound DNS resolver process to abort. This occurs when Unbound, compiled with assertions enabled, improperly handles an error value from the libngtcp2 library during DNS-over-QUIC (DoQ) connections, leading to an assertion failure and process termination.

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without ever reading the stream.