The CVE number for this vulnerability is CVE-2026-55991.


== Summary
A remote unauthenticated client can trigger a libngtcp2 assertion (if compiled
with assertions on) and terminate the entire Unbound process using a single
DNS-over-QUIC (DoQ) connection and one normal DNS query.
This is caused by an erroneous error value passed to libngtcp2.

Unbound 1.25.2 includes a fix to use the correct error code when calling
libngtcp2 functions.


== Affected products
Unbound 1.22.0 up to and including version 1.25.1.


== Description
When 'ngtcp2_conn_writev_stream()' returns
'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call
'ngtcp2_ccerr_set_application_error()' with a '-1' error value.
The 'int' literal '-1' is implicitly converted to the function's
'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'.
The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value
as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint
ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)'
and the whole resolver process aborts.
A remote, unauthenticated DoQ client can trigger this deterministically with
a single QUIC connection by advertising 'initial_max_stream_data_bidi_local =
1' in its transport parameters and sending one DoQ query without ever reading
the stream.

Unbound 1.25.2 includes a fix to use the correct error code when calling
libngtcp2 functions.

== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-55991_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-55991_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-55991.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks, also Xuanchao Xie,
for discovering and responsibly disclosing the vulnerability.