Unbound DNS CVE-2026-14586

Two explicit prerequisites must both be satisfied: (1) Unbound must have been compiled with '--with-libngtcp2', which is a non-default compile-time option enabling DNS-over-QUIC support; and (2) the 'quic-port' directive must be present in the Unbound configuration, enabling a DoQ listening interface. Beyond configuration, the assertion requires high concurrency and the resolver to be under load - a single or low-rate query stream is unlikely to trigger it. What limits exploitation: deployments compiled without libngtcp2 (the majority of packaged distributions that do not ship DoQ support), deployments where quic-port is not configured, and low-traffic resolvers where the race condition is unlikely to manifest. Authentication is not required (PR:N) - any client able to reach the DoQ port can contribute to the triggering condition.

The CVSS 3.1 score of 5.9 Medium (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the conditional nature of this vulnerability. The AC:H rating is justified: triggering the assertion requires both a specific non-default compile-time flag and a runtime configuration directive, plus sustained high-concurrency load - not a single malformed packet. The availability impact is rated High because successful triggering abruptly terminates the server rather than degrading it gracefully. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. There is no known public proof-of-concept. Real-world risk is substantially reduced by the deployment prerequisites: DoQ support in Unbound is an optional, non-default feature requiring explicit compile-time and runtime configuration. Organizations not running DoQ are entirely unaffected. Those that are should treat this as a moderate priority given the high availability impact if conditions are met.

An attacker aware that a target Unbound resolver has DoQ enabled (discoverable via QUIC handshake probing on the configured quic-port) sends a sustained flood of concurrent DoQ queries. Under sufficient load, Unbound passes a non-monotonic realtime timestamp to libngtcp2, triggering the assert and abruptly terminating the resolver process. No exploit code is publicly available; the attack requires generating genuine high-concurrency DoQ traffic rather than a single crafted packet.