CVE-2026-55991

A flaw was found in Unbound. A remote, unauthenticated client can exploit this vulnerability by sending a specially crafted DNS-over-QUIC (DoQ) connection and a single DNS query. This can trigger an assertion failure in the libngtcp2 library, leading to the termination of the entire Unbound process. This results in a Denial of Service (DoS), making the DNS resolver unavailable.

This Moderate flaw in Unbound allows a remote, unauthenticated client to cause a denial of service. By sending a specially crafted DNS-over-QUIC (DoQ) connection and a single DNS query, an attacker can terminate the Unbound process, making the DNS resolver unavailable. This vulnerability affects Unbound instances configured to support DoQ.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent exploitation, disable DNS-over-QUIC (DoQ) functionality within Unbound if it is not actively used. This typically involves adjusting Unbound's configuration to remove or comment out DoQ-related listening directives. After modifying the configuration, restart the Unbound service for the changes to take effect.