CVE-2026-14586: Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
Other sources
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.25.2-1 - Upgrade
Upgrade
NLnet Labs Unboundto a version that resolves this vulnerability.Fixed in 1.25.2 - Compensating control
Ensure Unbound is compiled with DoQ support using '--with-libngtcp2' and configure the 'quic-port' to be set for the listening interfaces, as DoQ environments in high concurrency require correct libngtcp2 timestamp behavior.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14586?
CVE-2026-14586 has a medium severity rating of 5.9.
What software is affected by CVE-2026-14586?
CVE-2026-14586 affects NLnet Labs Unbound versions 1.22.0 to 1.25.1.
How do I fix CVE-2026-14586?
To fix CVE-2026-14586, upgrade NLnet Labs Unbound to a version later than 1.25.1.
What type of vulnerability is CVE-2026-14586?
CVE-2026-14586 is an assertion failure in libngtcp2 that can occur in high concurrency DNS-over-QUIC environments.
What is the potential impact of CVE-2026-14586?
The potential impact of CVE-2026-14586 includes application crashes when under pressure in high concurrency scenarios.