CVE-2026-55991

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.25.1

Description A remote unauthenticated client can terminate the entire resolver process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This occurs when ngtcp2 conn writev stream() returns NGTCP2 ERR STREAM DATA BLOCKED, leading Unbound to call ngtcp2 ccerr set application error() with a -1 error value. This value is implicitly converted to 0xFFFFFFFFFFFFFFFF, which exceeds the 62-bit variable-length integer ceiling during serialization in ngtcp2 conn write connection close(). Consequently, ngtcp2 put uvarintlen() fails an assertion, causing the process to abort. An attacker can trigger this by advertising initial max stream data bidi local = 1 in transport parameters and sending a DoQ query without reading the stream.

Recommendations Update NLnet Labs Unbound to a version later than 1.25.1.