CVE-2026-14586
Received Received - Intake

Denial of Service in Unbound DNS Server via QUIC Timestamp Assertion

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-14586
EUVD
EUVD-2026-47662

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound From 1.22.0 (inc) to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects NLnet Labs Unbound DNS software versions 1.22.0 to 1.25.1 when using DNS-over-QUIC (DoQ). It occurs because Unbound uses real-time timestamps instead of monotonic timestamps when working with the libngtcp2 library. Under high concurrency and load, this triggers an assertion in libngtcp2, causing the server to crash and deny service.

Detection Guidance

Check if Unbound is running with DNS-over-QUIC (DoQ) support by verifying the 'quic-port' configuration and inspecting the process for '--with-libngtcp2' compilation flag. Monitor server logs for assertion errors or crashes during high concurrency.

Impact Analysis

If you run Unbound with DNS-over-QUIC enabled and high traffic, this flaw could cause your DNS server to crash repeatedly, leading to service outages and disrupted DNS resolution for users.

Compliance Impact

This vulnerability causes a denial of service in DNS-over-QUIC environments under high concurrency and load, which could disrupt critical network services. For compliance with standards like GDPR or HIPAA, such disruptions may impact availability requirements, potentially leading to violations if systems fail to maintain expected service levels.

Mitigation Strategies

Upgrade Unbound to version 1.25.2 or later. If upgrading is not possible, apply the manual patch to version 1.25.1. Disable DoQ support by removing 'quic-port' configuration if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart