CVE-2026-55991 in Unbound
Summary
by MITRE • 07/22/2026
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without ever reading the stream.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists in NLnet Labs Unbound versions 1.22.0 through 1.25.1 and represents a critical denial-of-service condition that can terminate the entire DNS resolver process. The flaw occurs within the DNS-over-QUIC implementation when handling connection errors, specifically involving the libngtcp2 library integration. The issue stems from improper error handling where Unbound passes an erroneous error value of -1 to the libngtcp2 library functions, triggering an assertion failure that causes process termination. This vulnerability is classified under CWE-681 as "Incorrect Use of a Computation Result" and represents a classic case of improper error code handling in network protocol implementations.
The technical execution path begins when a remote unauthenticated client establishes a DNS-over-QUIC connection and advertises an initial maximum stream data value of 1 in their transport parameters. The client then sends a single DoQ query without reading the response stream, which causes libngtcp2 to return NGTCP2_ERR_STREAM_DATA_BLOCKED error code. Unbound's handling logic continues processing this error condition by calling ngtcp2_ccerr_set_application_error() with a -1 literal value, which gets implicitly converted from int to uint64_t resulting in the maximum 64-bit unsigned integer value of 0xFFFFFFFFFFFFFFFF. This invalid error code subsequently gets passed to ngtcp2_conn_write_connection_close() which attempts to serialize it as a QUIC variable-length integer.
The serialization process fails because QUIC variable-length integers are limited to 62 bits, with the maximum valid value being 2^62-1, while the converted error code exceeds this limit. The ngtcp2_put_uvarintlen() function contains an assertion that validates the serialized length against a threshold of 4611686018427387904ULL, which is 2^62, causing the assertion to fail and triggering process abort. This represents a direct violation of the ATT&CK technique T1499.004 for "Network Denial of Service" as it allows remote attackers to cause system-wide service disruption through carefully crafted network traffic.
The operational impact is severe as this vulnerability can be exploited by any unauthenticated remote attacker with access to the DoQ port, requiring no authentication or privileged access. The attack is deterministic and requires only a single connection and query to trigger the process termination, making it highly effective for denial-of-service attacks against DNS services. Organizations using Unbound versions within the affected range face significant risk of service disruption, particularly in environments where DNS availability is critical for network operations and where DoQ functionality is enabled. The vulnerability affects both IPv4 and IPv6 deployments and can be exploited from any network location that can reach the target server's DoQ listening port.
Mitigation strategies include immediate patching to versions beyond 1.25.1 where this issue has been resolved, disabling DNS-over-QUIC functionality if not required for operations, or implementing network-level restrictions to limit access to DoQ ports from trusted sources only. Administrators should also consider monitoring for unusual connection patterns that might indicate exploitation attempts and implement proper intrusion detection rules targeting the specific error conditions described in this vulnerability. The fix implemented in later versions addresses the core issue by properly handling the error code conversion and ensuring that application-level error codes remain within valid QUIC integer limits, preventing the assertion failure that previously caused process termination.