The CVE number for this vulnerability is CVE-2026-14586.


== Summary
In DNS-over-QUIC environments, with high concurrency and under pressure, an
assertion in libngtcp2 about monotonic timestamps could trigger and result in
server termination and thus denial of service.

Unbound 1.25.2 includes a fix that explicitly uses monotonic time when
interfacing with libngtcp2.


== Affected products
Unbound 1.22.0 up to and including version 1.25.1.


== Description
When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is
expected to use monotonic time.
Unbound was using realtime instead, and in DoQ environments with high
concurrency and under pressure, an assert in libngtcp2 for the quic timestamp
would trigger and terminate the server.

This vulnerability needs Unbound to be compiled with DoQ support
('--with-libngtcp2') and the 'quic-port' to be configured for the listening
interfaces.

Unbound 1.25.2 includes a fix that explicitly uses monotonic time when
interfacing with libngtcp2.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-14586.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-14586.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Kunta Chu, Kaihua Wang, and Jianjun Chen from Tsinghua
University for discovering and responsibly disclosing the vulnerability.