CVE catalog

CVE-2026-55991

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process usi

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.36% · Oct 25, 2026

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without ever reading the stream.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianunboundsid1.26.2-1fixed
Debianunboundforky1.26.2-1fixed
Debianunboundtrixie1.22.0-2+deb13u3vulnerable
Debianunboundtrixie-security1.26.2-0+deb13u1fixed
Debianunboundbookworm1.17.1-2+deb12u4vulnerable
Debianunboundbookworm-security1.17.1-2+deb12u3vulnerable
Ubuntuunboundpro1.9.0-2ubuntu1vulnerable
Ubuntuunboundpro1.9.0-2ubuntu2vulnerable
Ubuntuunboundpro1.9.4-2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.3vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.4vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.5vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.6vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.8vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.9vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.2vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.4vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.7vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.8vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.10vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.11vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.12vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.13vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.14vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.15vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.16vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.17vulnerable
Ubuntuunbound24.041.17.1-2vulnerable
Ubuntuunbound24.041.18.0-2ubuntu1vulnerable
Ubuntuunbound24.041.18.0-2ubuntu2vulnerable
Ubuntuunbound24.041.19.1-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.2vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.4vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.5vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.6vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.7vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.8vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.9vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.10vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.12vulnerable
Ubuntuunbound26.101.24.2-1ubuntu2vulnerable
Ubuntuunbound26.101.25.1-1ubuntu1vulnerable
Ubuntuunbound26.101.25.1-1ubuntu3vulnerable
Ubuntuunbound26.041.22.0-2ubuntu2vulnerable
Ubuntuunbound26.041.22.0-2ubuntu4vulnerable
Ubuntuunbound26.041.24.2-1ubuntu1vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.1vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.2vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.3vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.4vulnerable
CpeunboundNot reported1.25.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianunboundsourcesid1.25.2-1not yet assignedNot reportedNot reported
Debianunboundsourceforky1.25.2-1not yet assignedNot reportedNot reported
Debianunboundsourcetrixie1.26.1-0+deb13u1not yet assignedNot reportedNot reported
Debianunboundsourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpeunboundcpeNot reported1.25.2Not reportedNVD-CVE-2026-55991Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libunbound8]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [libunbound-dev]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [python3-unbound]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound]Affected
    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound-anchor]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound-host]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

[Debian 13 (Trixie)]

  • [libunbound8]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [libunbound-dev]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [python3-unbound]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [unbound]Affected
    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [unbound-anchor]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [unbound-host]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]