Medium [CVE-2026-55991] Denial of Service via crafted DNS-over-QUIC connection
This medium-severity Red Hat Linux advisory covers CVE-2026-55991 affecting Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2.
When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'.
The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts.
A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without ever reading the stream. A flaw was found in Unbound.
This results in a Denial of Service (DoS), making the DNS resolver unavailable. This Moderate flaw in Unbound allows a remote, unauthenticated client to cause a denial of service.
- 1.22.0
- 1.25.1
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
- unbound-main-1.25.2-0.1.hum1
- RHSA-2026:43588
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Mitigation checklist
- To prevent exploitation, disable DNS-over-QUIC (DoQ) functionality within Unbound if it is not actively used. This typically involves adjusting Unbound's configuration to remove or comment out DoQ-related listening directives. After modifying the configuration, restart the Unbound service for the changes to take effect.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.