Unbound DNS Resolver CVE-2026-55991

Three specific conditions must all be true simultaneously for exploitation to succeed. First, DNS-over-QUIC (DoQ) must be explicitly configured as an active listener in Unbound - DoQ is not enabled by default; it requires explicit interface directives in unbound.conf pointing to a QUIC endpoint. Second, the Unbound binary must have been compiled with C assertion macros active, meaning the build did NOT define -DNDEBUG; most distribution-provided packages disable assertions in release builds, so this primarily affects source-compiled or development builds. Third, the attacker must have network-layer reachability to the DoQ UDP port (typically 853) - standard firewall controls that restrict external access to this port are an effective barrier. What limits exploitation beyond CVSS: no authentication, no user interaction, and no special application-layer privilege is required once the two structural prerequisites (DoQ enabled, assertions compiled in) are satisfied. Exploitation against default Unbound installations (no DoQ, standard distribution packages) is not possible.

The NVD CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (score 5.9) correctly captures the network-reachable, unauthenticated nature of the attack but rates complexity High, reflecting the two non-default prerequisites: Unbound must be compiled with assertion macros active, and DNS-over-QUIC must be configured. Production builds from major Linux distribution packages (Debian, RHEL, Alpine) typically compile with optimizations that disable assertions (-DNDEBUG), substantially narrowing the real-world attack surface. However, source-built deployments, BSD-based firewall appliances (pfSense, OPNsense), and any operator who explicitly enables DoQ for privacy-preserving resolver services are genuinely exposed. The denial-of-service impact is severe: the entire Unbound process aborts, not just the affected connection, meaning all resolving clients lose service simultaneously. No EPSS score was available in the provided intelligence; the absence of KEV listing and POC code means the probability of observed exploitation is currently low, but the attack is described as entirely deterministic - any actor who reads the advisory can reproduce it without exploit development skill. Impact is purely availability (C:N/I:N/A:H); confidentiality and integrity are unaffected. The gap between CVSS complexity (High) and actual attack complexity (deterministic, single-packet-equivalent trigger once prerequisites are met) suggests defenders should treat this as operationally simpler than AC:H implies, contingent on the compilation and configuration prerequisites being satisfied.

An attacker with network access to an Unbound DoQ listener (typically UDP port 853) opens a QUIC connection and advertises initial_max_stream_data_bidi_local = 1 in the ClientHello transport parameters, constraining Unbound's stream write buffer to one byte. The attacker then sends a single valid DNS query over the DoQ stream but never reads the response stream, causing Unbound's write attempt to return NGTCP2_ERR_STREAM_DATA_BLOCKED. Unbound's error path invokes ngtcp2_ccerr_set_application_error(-1), the -1 widens to 0xFFFFFFFFFFFFFFFF, the assertion in ngtcp2_put_uvarintlen() fires, and the entire Unbound process aborts - taking down DNS resolution for all clients served by that instance. No POC code has been identified in the provided data, but the attack requires no brute force or timing, making it trivially reproducible from the advisory description alone.