CVE-2026-55991: NLnet Labs Unbound DoS Vulnerability

CVE-2026-55991 Overview

CVE-2026-55991 is a denial-of-service vulnerability in NLnet Labs Unbound, an open-source recursive DNS resolver. The flaw affects Unbound versions 1.22.0 through 1.25.1 when compiled with assertions enabled and DNS-over-QUIC (DoQ) support. A remote, unauthenticated client can terminate the entire Unbound process using a single DoQ connection and one DNS query. The bug results from an erroneous -1 error value passed to libngtcp2, which triggers an assertion failure in ngtcp2_put_uvarintlen() and aborts the resolver. The issue is classified as [CWE-195] Signed to Unsigned Conversion Error.

Critical Impact
A single QUIC connection with crafted transport parameters can crash the Unbound resolver process, disrupting DNS resolution for all downstream clients.

Affected Products

NLnet Labs Unbound 1.22.0
NLnet Labs Unbound versions up to and including 1.25.1
Builds compiled with assertions enabled and DoQ support

Discovery Timeline

2026-07-22 - CVE-2026-55991 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-55991

Vulnerability Analysis

The vulnerability resides in Unbound's DNS-over-QUIC handling path. When ngtcp2_conn_writev_stream() returns NGTCP2_ERR_STREAM_DATA_BLOCKED, Unbound proceeds to call ngtcp2_ccerr_set_application_error() with a literal -1 as the error code. The signed int value implicitly converts to the function's uint64_t error_code parameter, yielding 0xFFFFFFFFFFFFFFFF. The follow-on ngtcp2_conn_write_connection_close() then attempts to serialise that value as a QUIC variable-length integer.

Because 2^64-1 exceeds the 62-bit varint ceiling defined by RFC 9000, ngtcp2_put_uvarintlen() fails the internal assert(n < 4611686018427387904ULL) check. When Unbound is compiled with assertions enabled, this aborts the entire resolver process. The flaw is deterministic and requires no authentication.

Root Cause

The root cause is an improper signed-to-unsigned conversion. Unbound passes the sentinel value -1 where the API contract requires a valid QUIC application error code within the 62-bit varint range. The type coercion transforms -1 into the maximum 64-bit unsigned integer, which is not representable as a QUIC varint. This violates a downstream invariant in libngtcp2 that is enforced via assertion.

Attack Vector

A remote unauthenticated DoQ client triggers the crash by establishing a single QUIC connection to the Unbound DoQ listener. The client advertises initial_max_stream_data_bidi_local = 1 in its transport parameters, then sends one DoQ query without reading the response stream. The tiny flow-control window causes ngtcp2_conn_writev_stream() to return NGTCP2_ERR_STREAM_DATA_BLOCKED, which drives Unbound down the faulty error-handling path and aborts the process. No verified public exploit code is available. See the NLnet Labs CVE-2026-55991 Advisory for the vendor's technical description.

Detection Methods for CVE-2026-55991

Indicators of Compromise

Unexpected termination of the Unbound process with an assertion failure referencing ngtcp2_put_uvarintlen or assert(n < 4611686018427387904ULL)
Core dumps generated by the Unbound service after receiving DoQ traffic
Sudden loss of DNS resolution correlated with inbound UDP traffic on the configured DoQ port (typically 853/udp)

Detection Strategies

Monitor Unbound service uptime and restart counts through systemd, supervisord, or equivalent process supervisors
Inspect Unbound logs and system journal for SIGABRT termination events tied to the resolver PID
Capture QUIC traffic on the DoQ listener port and flag connections that advertise abnormally small initial_max_stream_data_bidi_local values

Monitoring Recommendations

Alert on repeated Unbound crashes within short time windows to identify active exploitation attempts
Track DoQ connection source IPs and rate-limit clients that repeatedly trigger stream-blocked conditions
Forward Unbound stderr and core dump metadata into centralized logging for retrospective analysis

How to Mitigate CVE-2026-55991

Immediate Actions Required

Upgrade Unbound to a version that addresses CVE-2026-55991 as published in the NLnet Labs advisory
If patching is not immediately possible, disable the DoQ listener in unbound.conf until the fix is deployed
Restrict inbound access to the DoQ port to trusted client networks using host or network firewalls

Patch Information

NLnet Labs has published guidance for CVE-2026-55991 in the NLnet Labs CVE-2026-55991 Advisory. Operators should apply the fixed release and rebuild any downstream packages. Distributions that ship Unbound with assertions enabled should update to the vendor-supplied patched version.

Workarounds

Rebuild Unbound with assertions disabled to prevent the process abort, accepting the risk of undefined behaviour in the affected code path
Disable DNS-over-QUIC by removing or commenting out DoQ listener directives in the Unbound configuration
Place Unbound behind a QUIC-aware reverse proxy or load balancer that terminates DoQ and validates transport parameters before forwarding

bash

# Example: disable the DoQ listener in unbound.conf
server:
    # interface: 0.0.0.0@853
    # tls-service-key: "/etc/unbound/tls.key"
    # tls-service-pem: "/etc/unbound/tls.pem"
    # Disable DoQ until the patched build is deployed
    # (Remove or comment any 'interface: ...@853' lines used for QUIC)