Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55991— Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

Quick assessment

Affected
NLnet Labs Unbound
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NLnet Labs Unbound是荷兰NLnet Labs组织的域名系统解析服务器。 NLnet Labs Unbound 1.22.0版本至1.25.1版本存在数字错误漏洞，该漏洞源于将错误值'-1'传递给libngtcp2函数'ngtcp2_ccerr_set_application_error()'，导致隐式转换为'0xFFFFFFFFFFFFFFFF'，进而触发断言失败，可能允许远程未经身份验证的客户端通过单个DNS-over-QUIC连接和一次正常DNS查询终止整个Unbound进程。

CVSS 5.9 · Medium EPSS 0.24% · P15

Affected Version Matrix 1

VendorProduct Version RangeStatus
NLnet Labs Unbound 1.22.0< 1.25.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55991

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
Source: CVE Program / CVE List V5
Vulnerability Description
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without ever reading the stream.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
有符号至无符号转换错误
Source: CVE Program / CVE List V5
Vulnerability Title
NLnet Labs Unbound 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NLnet Labs Unbound是荷兰NLnet Labs组织的域名系统解析服务器。 NLnet Labs Unbound 1.22.0版本至1.25.1版本存在数字错误漏洞，该漏洞源于将错误值'-1'传递给libngtcp2函数'ngtcp2_ccerr_set_application_error()'，导致隐式转换为'0xFFFFFFFFFFFFFFFF'，进而触发断言失败，可能允许远程未经身份验证的客户端通过单个DNS-over-QUIC连接和一次正常DNS查询终止整个Unbound进程。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
NLnet Labs Unbound 1.22.0 ~ 1.25.2 -

II. Public POCs for CVE-2026-55991

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55991

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-55991 (1)

Same Patch Batch · NLnet Labs · 2026-07-22 · 24 CVEs total

CVE-2026-55973 7.5 HIGH 'dns-error-reporting: yes' leads to stack buffer overflow
CVE-2026-44690 7.5 HIGH Cross-zone wildcard cache poisoning via RRSIG.labels manipulation
CVE-2026-32665 7.5 HIGH Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass
CVE-2026-40691 7.5 HIGH Packet of death for DNSCrypt over TCP
CVE-2026-50248 6.5 MEDIUM BOGUS configured primary hostname accepted for XFR in auth/rpz zones
CVE-2026-50046 5.9 MEDIUM Possible heap use-after-free in an error path when a DoT forwarded query is jostled out
CVE-2026-55717 5.9 MEDIUM 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash
CVE-2026-55990 5.9 MEDIUM Packet of death for a DNSCrypt misconfigured Unbound
CVE-2026-56444 5.9 MEDIUM Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout
CVE-2026-44621 5.9 MEDIUM Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abr
CVE-2026-52863 5.9 MEDIUM Memory corruption could lead to crash and denial of service
CVE-2026-14586 5.9 MEDIUM Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
CVE-2026-50251 5.3 MEDIUM Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush
CVE-2026-50045 5.3 MEDIUM 'max-global-quota' reset by DNSSEC validation restarts
CVE-2026-56416 4.8 MEDIUM Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name
CVE-2026-42955 3.7 LOW Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-tim
CVE-2026-54478 3.7 LOW DNS Cookie bypass when combined with proxy-protocol use
CVE-2026-44687 3.7 LOW Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legi
CVE-2026-46582 3.7 LOW A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply
CVE-2026-41637 3.7 LOW Degradation of resolution service from improperly accounted client-terminated DNS-over-QUI

Showing top 20 of 24 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Unbound
Same vendor: NLnet Labs
Same weakness: CWE-195

V. Comments for CVE-2026-55991

No comments yet

Leave a comment