Log in Start free

Vulnerability · Published Jul 22, 2026 · Assigned by NLnet Labs

CVE-2026-14586Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments

Medium 5.9

In plain English

A medium-severity security flaw in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.4%top 69.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12unboundno fix listedDEBIAN-CVE-2026-14586
Debian:13unbound1.26.1-0+deb13u1DEBIAN-CVE-2026-14586
Debian:14unbound1.25.2-1DEBIAN-CVE-2026-14586
Ubuntu:22.04:LTSunboundno fix listedUBUNTU-CVE-2026-14586
Ubuntu:24.04:LTSunboundno fix listedUBUNTU-CVE-2026-14586
Ubuntu:26.04:LTSunboundno fix listedUBUNTU-CVE-2026-14586
Ubuntu:26.10unboundno fix listedUBUNTU-CVE-2026-14586

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound 1.22.0 – before 1.25.2

Weakness: CWE-617 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References