CVE-2026-14586

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-14586.txt

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) En NLnet Labs Unbound 1.22.0 hasta la versión 1.25.1 inclusive, en entornos DNS-over-QUIC, con alta concurrencia y bajo presión, una aserción en libngtcp2 sobre marcas de tiempo monotónicas podría activarse y resultar en la terminación del servidor y, por lo tanto, en denegación de servicio. Al interactuar con libngtcp2, para el soporte de DNS-over-QUIC en Unbound, se espera que utilice tiempo monotónico. Unbound estaba usando tiempo real en su lugar, y en entornos DoQ con alta concurrencia y bajo presión, una aserción en libngtcp2 para la marca de tiempo QUIC se activaría y terminaría el servidor. Esta vulnerabilidad requiere que Unbound sea compilado con soporte DoQ (’--with-libngtcp2’) y que el ’quic-port’ sea configurado para las interfaces de escucha.

Information

Published : 2026-07-22 14:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-14586

Mitre link : CVE-2026-14586

CVE.ORG link : CVE-2026-14586

JSON object : View

Products Affected

No product.

CWE

CWE-617

Reachable Assertion

{"id": "CVE-2026-14586", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14586", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T14:32:40.727677Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "sep@nlnetlabs.nl", "affectedData": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.22.0", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T14:17:15.020", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-14586.txt", "source": "sep@nlnetlabs.nl"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces."}, {"lang": "es", "value": "En NLnet Labs Unbound 1.22.0 hasta la versi\u00f3n 1.25.1 inclusive, en entornos DNS-over-QUIC, con alta concurrencia y bajo presi\u00f3n, una aserci\u00f3n en libngtcp2 sobre marcas de tiempo monot\u00f3nicas podr\u00eda activarse y resultar en la terminaci\u00f3n del servidor y, por lo tanto, en denegaci\u00f3n de servicio. Al interactuar con libngtcp2, para el soporte de DNS-over-QUIC en Unbound, se espera que utilice tiempo monot\u00f3nico. Unbound estaba usando tiempo real en su lugar, y en entornos DoQ con alta concurrencia y bajo presi\u00f3n, una aserci\u00f3n en libngtcp2 para la marca de tiempo QUIC se activar\u00eda y terminar\u00eda el servidor. Esta vulnerabilidad requiere que Unbound sea compilado con soporte DoQ (\u2019--with-libngtcp2\u2019) y que el \u2019quic-port\u2019 sea configurado para las interfaces de escucha."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "sep@nlnetlabs.nl"}