CVE-2026-55991 NLnet Labs CVE debrief

Who should care

Users of Unbound 1.22.0 through 1.25.1, especially those exposed to remote unauthenticated clients, should assess and mitigate this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the affected scope, severity, and vendor guidance.

Technical summary

In Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion failure and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts.

Defensive priority

High

Recommended defensive actions

• Update Unbound to a version that fixes this vulnerability
• Restrict access to Unbound to only trusted clients
• Monitor Unbound logs for signs of exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-22T14:17:21.957Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability affects Unbound 1.22.0 through 1.25.1, and a remote unauthenticated client can trigger a libngtcp2 assertion failure and terminate the Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query.

Official resources