CVE-2026-14586: NLnet Labs Unbound DoS Vulnerability

CVE-2026-14586 Overview

CVE-2026-14586 is a denial-of-service vulnerability in NLnet Labs Unbound, a widely deployed recursive DNS resolver. The flaw affects versions 1.22.0 through 1.25.1 when compiled with DNS-over-QUIC (DoQ) support via --with-libngtcp2 and configured with an active quic-port. Under high concurrency and load, Unbound passes non-monotonic (realtime) timestamps to libngtcp2, which expects monotonic time. This triggers a runtime assertion inside libngtcp2 and terminates the Unbound process. The result is service disruption for all DNS clients depending on the resolver. The issue is classified under [CWE-617] Reachable Assertion.

Critical Impact
Remote attackers can crash Unbound resolvers with DoQ enabled by driving concurrent DoQ traffic, resulting in loss of DNS resolution for downstream clients.

Affected Products

NLnet Labs Unbound 1.22.0 through 1.25.1 (inclusive)
Only builds compiled with --with-libngtcp2 (DNS-over-QUIC support)
Only deployments with quic-port configured on listening interfaces

Discovery Timeline

2026-07-22 - CVE-2026-14586 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-14586

Vulnerability Analysis

Unbound integrates with libngtcp2 to provide DNS-over-QUIC transport. The libngtcp2 library requires callers to supply monotonic timestamps for QUIC connection state and timer management. Monotonic clocks guarantee non-decreasing values, which QUIC state machines rely on for retransmission timers, congestion control, and packet number spaces.

Unbound instead supplied realtime clock values to libngtcp2. Realtime clocks can jump backward due to NTP adjustments, leap second handling, or administrator changes. Under high DoQ concurrency, the library observes a timestamp that violates its monotonicity invariant. libngtcp2 enforces this invariant with an assertion, and the assertion failure terminates the entire Unbound process.

Root Cause

The root cause is incorrect clock source selection at the Unbound-to-libngtcp2 interface. The code path used CLOCK_REALTIME semantics where CLOCK_MONOTONIC was required by the library contract. This is a reachable assertion defect ([CWE-617]) rather than a memory safety issue.

Attack Vector

An unauthenticated remote attacker sends concurrent DoQ queries to a vulnerable Unbound instance. Sustained load increases the probability that Unbound reads a realtime clock value that appears non-monotonic to libngtcp2, tripping the assertion. Attack complexity is high because the trigger depends on timing and clock adjustments occurring during load. Successful exploitation crashes the resolver, breaking DNS resolution for all dependent clients until the process restarts.

No public exploit is available, and CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog. Refer to the NLnet Labs CVE-2026-14586 Documentation for authoritative technical details.

Detection Methods for CVE-2026-14586

Indicators of Compromise

Unbound process termination events accompanied by libngtcp2 assertion messages in system logs or stderr.
Unexpected Unbound service restarts correlated with spikes in DoQ traffic on the configured quic-port.
DNS resolution outages reported by downstream clients coinciding with QUIC connection floods.

Detection Strategies

Inventory all Unbound builds and check whether --with-libngtcp2 was enabled and quic-port is set in unbound.conf.
Monitor Unbound version strings across the environment and flag any instance in the 1.22.0 to 1.25.1 range.
Alert on repeated Unbound crash-restart cycles via systemd, supervisord, or process supervisor telemetry.

Monitoring Recommendations

Ingest Unbound stderr and syslog output into a centralized logging pipeline and alert on assert or ngtcp2 keywords.
Track DoQ query rate and connection counts per source to identify abusive concurrency patterns.
Correlate DNS availability metrics with resolver process uptime to detect user-impacting crashes quickly.

How to Mitigate CVE-2026-14586

Immediate Actions Required

Upgrade Unbound to a fixed release published after 1.25.1 as provided by NLnet Labs.
If patching is not immediately possible, disable DoQ by removing quic-port from unbound.conf and reloading the service.
Restrict DoQ exposure to trusted networks using firewall rules on UDP/443 or the configured QUIC port.

Patch Information

NLnet Labs addresses the defect by switching the timestamp source supplied to libngtcp2 to a monotonic clock. Consult the NLnet Labs CVE-2026-14586 Documentation for the specific fixed version and release notes, then upgrade through your distribution package manager or rebuild from source against the corrected release.

Workarounds

Rebuild Unbound without --with-libngtcp2 if DoQ is not required in your deployment.
Comment out or remove the quic-port directive from unbound.conf to stop listening for DoQ traffic.
Place a rate limiter or QUIC-aware proxy in front of Unbound to cap concurrent DoQ connections and reduce trigger probability.

bash

# Configuration example: disable DoQ in unbound.conf
# server:
#     quic-port: 853        # <-- comment out or remove this line
#     tls-service-key: "/etc/unbound/tls.key"
#     tls-service-pem: "/etc/unbound/tls.pem"

sudo sed -i 's/^\s*quic-port:/# quic-port:/' /etc/unbound/unbound.conf
sudo unbound-checkconf
sudo systemctl reload unbound