CVE-2026-14586

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14586", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "state": "PUBLISHED", "assignerShortName": "NLnet Labs", "dateReserved": "2026-07-03T11:59:36.383Z", "datePublished": "2026-07-22T13:03:53.107Z", "dateUpdated": "2026-07-22T14:33:23.363Z"}, "containers": {"cna": {"title": "Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments", "datePublic": "2026-07-22T00:00:00.000Z", "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"version": "1.22.0", "status": "affected", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "Unbound compiled with DoQ support ('--with-libngtcp2')"}], "cvssV3_1": {"version": "3.1", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-617", "description": "CWE-617: Reachable Assertion", "type": "CWE"}]}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.25.2"}], "timeline": [{"time": "2026-05-08T00:00:00.000Z", "lang": "en", "value": "Issue reported by Kunta Chu"}, {"time": "2026-07-02T00:00:00.000Z", "lang": "en", "value": "NLnet Labs shares patch with Kunta Chu"}, {"time": "2026-07-03T00:00:00.000Z", "lang": "en", "value": "Kunta Chu verifies patch"}, {"time": "2026-07-22T00:00:00.000Z", "lang": "en", "value": "Fixes released with version 1.25.2"}], "credits": [{"lang": "en", "value": "Kunta Chu (Tsinghua University)", "type": "finder"}, {"lang": "en", "value": "Kaihua Wang (Tsinghua University)", "type": "finder"}, {"lang": "en", "value": "Jianjun Chen (Tsinghua University)", "type": "finder"}], "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-14586.txt", "tags": ["vendor-advisory"]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-07-22T13:03:53.107Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T14:32:40.727677Z", "id": "CVE-2026-14586", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:33:23.363Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-14586", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T14:32:40.727677Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:33:17.415Z"}}], "cna": {"title": "Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments", "credits": [{"lang": "en", "type": "finder", "value": "Kunta Chu (Tsinghua University)"}, {"lang": "en", "type": "finder", "value": "Kaihua Wang (Tsinghua University)"}, {"lang": "en", "type": "finder", "value": "Jianjun Chen (Tsinghua University)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "Unbound compiled with DoQ support ('--with-libngtcp2')"}]}], "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.22.0", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-08T00:00:00.000Z", "value": "Issue reported by Kunta Chu"}, {"lang": "en", "time": "2026-07-02T00:00:00.000Z", "value": "NLnet Labs shares patch with Kunta Chu"}, {"lang": "en", "time": "2026-07-03T00:00:00.000Z", "value": "Kunta Chu verifies patch"}, {"lang": "en", "time": "2026-07-22T00:00:00.000Z", "value": "Fixes released with version 1.25.2"}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.25.2"}], "datePublic": "2026-07-22T00:00:00.000Z", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-14586.txt", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617: Reachable Assertion"}]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-07-22T13:03:53.107Z"}}}, "cveMetadata": {"cveId": "CVE-2026-14586", "state": "PUBLISHED", "dateUpdated": "2026-07-22T14:33:23.363Z", "dateReserved": "2026-07-03T11:59:36.383Z", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "datePublished": "2026-07-22T13:03:53.107Z", "assignerShortName": "NLnet Labs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Unbound", "vendor": "NLnet Labs", "versions": [{"lessThan": "1.25.2", "status": "affected", "version": "1.22.0", "versionType": "semver"}]}], "source": "sep@nlnetlabs.nl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces."}, {"lang": "es", "value": "En NLnet Labs Unbound 1.22.0 hasta la versi\u00f3n 1.25.1 inclusive, en entornos DNS-over-QUIC, con alta concurrencia y bajo presi\u00f3n, una aserci\u00f3n en libngtcp2 sobre marcas de tiempo monot\u00f3nicas podr\u00eda activarse y resultar en la terminaci\u00f3n del servidor y, por lo tanto, en denegaci\u00f3n de servicio. Al interactuar con libngtcp2, para el soporte de DNS-over-QUIC en Unbound, se espera que utilice tiempo monot\u00f3nico. Unbound estaba usando tiempo real en su lugar, y en entornos DoQ con alta concurrencia y bajo presi\u00f3n, una aserci\u00f3n en libngtcp2 para la marca de tiempo QUIC se activar\u00eda y terminar\u00eda el servidor. Esta vulnerabilidad requiere que Unbound sea compilado con soporte DoQ (\u2019--with-libngtcp2\u2019) y que el \u2019quic-port\u2019 sea configurado para las interfaces de escucha."}], "id": "CVE-2026-14586", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "sep@nlnetlabs.nl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14586", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T14:32:40.727677Z", "version": "2.0.3"}}]}, "published": "2026-07-22T14:17:15.020", "references": [{"source": "sep@nlnetlabs.nl", "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-14586.txt"}], "sourceIdentifier": "sep@nlnetlabs.nl", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "sep@nlnetlabs.nl", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:43588", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "unbound-main-1.25.2-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-22T00:00:00Z"}], "bugzilla": {"description": "unbound: libngtcp2: Unbound: Denial of Service via assertion failure in DNS-over-QUIC environments", "id": "2506128", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506128"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-617", "details": ["A flaw was found in Unbound. Under heavy DNS-over-QUIC (DoQ) traffic, a timing discrepancy in Unbound\u2019s libngtcp2 library can trigger an assertion failure. This causes the server to crash unexpectedly, resulting in a denial of service (DoS)."], "mitigation": {"lang": "en:us", "value": "Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file.\nRestart the unbound service for the changes to take effect and prevent potential assertion crashes."}, "name": "CVE-2026-14586", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "unbound", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "unbound", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "unbound", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "unbound", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "unbound", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-07-22T13:03:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-14586\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-14586\nhttps://www.nlnetlabs.nl/downloads/unbound/CVE-2026-14586.txt"], "statement": "Moderate: This Unbound vulnerability, leading to a denial of service, is contingent on the resolver being compiled with DNS-over-QUIC (DoQ) support and having a `quic-port` configured. The flaw manifests under high concurrency and network pressure due to a timing discrepancy in the `libngtcp2` library. Red Hat deployments not utilizing DoQ or without the `quic-port` enabled are not affected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.22.0,1.25.2)"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Unbound", "source": "cna", "vendor": "NLnet Labs"}, "product": "unbound", "vendor": "nlnetlabs"}], "created": "2026-07-23T19:00:17.243998+00:00", "updated": "2026-08-04T16:00:12.389481+00:00", "vendors": ["nlnetlabs", "nlnetlabs$PRODUCT$unbound"]}