Unbound 1.22-1.25.1 DoQ crash via libngtcp2 assertion
CVE-2026-55991 Published on July 22, 2026
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without ever reading the stream.
Timeline
Issue reported by Qifan Zhang
NLnet Labs shares patch with Qifan Zhang 19 days later.
Qifan Zhang verifies patch 2 days later.
Issue reported by Xuanchao Xie 24 days later.
NLnet Labs shares patch with Xuanchao Xie 1 day later.
Xuanchao Xie verifies patch
Fixes released with version 1.25.2 39 days later.
Weakness Type
Signed to Unsigned Conversion Error
The software uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
Products Associated with CVE-2026-55991
Want to know whenever a new CVE is published for Nlnetlabs Unbound? stack.watch will email you.
Affected Versions
NLnet Labs Unbound:- Version 1.22.0 and below 1.25.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.