Skip to main content

Unbound DNS Resolver CVE-2026-55991

| EUVDEUVD-2026-47683 MEDIUM
Signed to Unsigned Conversion Error (CWE-195)
2026-07-22 NLnet Labs GHSA-j6hj-wvx2-8wqp
Denial Of Service Unbound Red Hat Suse
5.9
CVSS 3.1 · Vendor: NLnet Labs
Share

Severity by source

Vendor (NLnet Labs) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

AV:N and PR:N confirmed by description; AC:H reflects two non-default prerequisites (assertions compiled in, DoQ configured); A:H for full process abort.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 22, 2026 - 16:18 EUVD
Analysis Generated
Jul 22, 2026 - 13:57 vuln.today

DescriptionCVE.org

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without ever reading the stream.

AnalysisAI

Remote unauthenticated termination of Unbound 1.22.0 through 1.25.1 is possible via a crafted DNS-over-QUIC (DoQ) connection that exploits a signed-to-unsigned integer conversion error when Unbound mishandles the NGTCP2_ERR_STREAM_DATA_BLOCKED error condition. The flaw propagates an implicit conversion of the C literal -1 to a 64-bit unsigned integer (0xFFFFFFFFFFFFFFFF), which exceeds the 62-bit QUIC varint ceiling and triggers a libngtcp2 assertion that aborts the entire resolver process. Exploitation is deterministic - a single QUIC connection with one crafted transport parameter and one DNS query is sufficient - though the attack surface is constrained to deployments compiled with assertions enabled and DoQ actively configured. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The root cause is CWE-195 (Incorrect Conversion between Numeric Types): a signed int literal -1 is passed to ngtcp2_ccerr_set_application_error(), which accepts a uint64_t error_code parameter. C's implicit integer conversion rules widen -1 to the maximum unsigned 64-bit value, 0xFFFFFFFFFFFFFFFF (2^64-1). This value is subsequently serialized by ngtcp2_conn_write_connection_close() as a QUIC variable-length integer (varint). QUIC varints are capped at 62 bits (maximum 2^62-1 = 4611686018427387903); the value 2^64-1 far exceeds this ceiling. The libngtcp2 encoding function ngtcp2_put_uvarintlen() contains a hard assertion assert(n < 4611686018427387904ULL) that fails, causing an abort(). The trigger mechanism is the QUIC transport parameter initial_max_stream_data_bidi_local = 1, which constrains the peer's stream send buffer to one byte, producing stream backpressure (NGTCP2_ERR_STREAM_DATA_BLOCKED) when Unbound attempts to write a DoQ response. Unbound's error handling path then incorrectly calls the connection-close path with the invalid error code. The affected product is identified via CPE cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:* across versions 1.22.0 to 1.25.1.

RemediationAI

The primary remediation is to upgrade Unbound to the version designated as fixed in the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55991.txt - the exact patched release number was not confirmed in the available intelligence and should be verified directly against the advisory before deployment. Until patching is possible, the most effective compensating control is to disable DNS-over-QUIC support by removing or commenting out any interface: ... @853 quic or equivalent DoQ listener configuration in unbound.conf and restarting the service; this eliminates the attack surface entirely with no impact on standard DNS-over-UDP/TCP or DNS-over-TLS clients. An alternative workaround is to rebuild Unbound with -DNDEBUG in CFLAGS to disable assertion checks, which prevents the abort - however, this suppresses the assertion without fixing the underlying erroneous error code, and the resulting behavior (connection close with a malformed varint) may produce undefined or protocol-violating behavior in libngtcp2; this workaround is not recommended for production without vendor guidance. If DoQ is operationally required and patching is delayed, network-level controls (firewall rules restricting UDP/853 to known, trusted client IP ranges) reduce exposure but do not eliminate it against legitimate DoQ clients.

More in Unbound

View all
CVE-2019-18934 HIGH POC
7.3 Nov 19

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
CVE-2026-33278 CRITICAL
9.1 May 20

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
CVE-2026-42959 HIGH
8.7 May 20

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
CVE-2026-42944 HIGH
8.7 May 20

Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
CVE-2026-32665 HIGH
7.5 Jul 22

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
CVE-2026-55973 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone

CVE-2026-40691 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
CVE-2026-44690 HIGH
7.5 Jul 22

DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
CVE-2022-3204 HIGH
7.5 Sep 26

A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
CVE-2020-10772 HIGH
7.5 Nov 27

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020
CVE-2020-12663 HIGH
7.5 May 19

Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Rated high severity
CVE-2020-12662 HIGH
7.5 May 19

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. Rated high severity

Same weakness CWE-195 – Signed to Unsigned Conversion Error

View all
CVE-2023-3635 HIGH POC
7.5
CVE-2026-26981 MEDIUM POC
6.5
CVE-2016-6560 HIGH
8.6
CVE-2024-25388 HIGH
8.4
CVE-2020-1913 HIGH
8.1
CVE-2020-6096 HIGH
8.1
CVE-2023-33034 HIGH
7.8
CVE-2025-30646 HIGH
7.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected

Share

CVE-2026-55991 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy