CVE-2026-14586

A flaw was found in Unbound. Under heavy DNS-over-QUIC (DoQ) traffic, a timing discrepancy in Unbound’s libngtcp2 library can trigger an assertion failure. This causes the server to crash unexpectedly, resulting in a denial of service (DoS).

Moderate: This Unbound vulnerability, leading to a denial of service, is contingent on the resolver being compiled with DNS-over-QUIC (DoQ) support and having a quic-port configured. The flaw manifests under high concurrency and network pressure due to a timing discrepancy in the libngtcp2 library. Red Hat deployments not utilizing DoQ or without the quic-port enabled are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.