CVE-2026-14586

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.25.1

Description In DNS-over-QUIC (DoQ) environments, high concurrency and system pressure can trigger an assertion in the libngtcp2 library regarding monotonic timestamps. This occurs because Unbound uses realtime instead of the expected monotonic time when interfacing with libngtcp2, leading to server termination and a denial of service. This issue requires Unbound to be compiled with DoQ support using the --with-libngtcp2 flag and the quic-port to be configured for the listening interfaces.

Recommendations For versions 1.22.0 through 1.25.1, update the software to a version where this issue is resolved. As a temporary mitigation, avoid configuring the quic-port for listening interfaces or disable DNS-over-QUIC support.