CVE-2026-55991— Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
Possible ATT&CK Techniques 2AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55991
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
Source: NVD (National Vulnerability Database)
Vulnerability Description
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without ever reading the stream.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
有符号至无符号转换错误
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NLnet Labs | Unbound | 1.22.0 ~ 1.25.2 | - |
II. Public POCs for CVE-2026-55991
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55991
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-55991 (1)
Same Patch Batch · NLnet Labs · 2026-07-22 · 24 CVEs total
| CVE-2026-55973 | 7.5 HIGH | 'dns-error-reporting: yes' leads to stack buffer overflow |
| CVE-2026-44690 | 7.5 HIGH | Cross-zone wildcard cache poisoning via RRSIG.labels manipulation |
| CVE-2026-32665 | 7.5 HIGH | Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass |
| CVE-2026-40691 | 7.5 HIGH | Packet of death for DNSCrypt over TCP |
| CVE-2026-50248 | 6.5 MEDIUM | BOGUS configured primary hostname accepted for XFR in auth/rpz zones |
| CVE-2026-50046 | 5.9 MEDIUM | Possible heap use-after-free in an error path when a DoT forwarded query is jostled out |
| CVE-2026-55717 | 5.9 MEDIUM | 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash |
| CVE-2026-55990 | 5.9 MEDIUM | Packet of death for a DNSCrypt misconfigured Unbound |
| CVE-2026-56444 | 5.9 MEDIUM | Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout |
| CVE-2026-44621 | 5.9 MEDIUM | Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abr |
| CVE-2026-52863 | 5.9 MEDIUM | Memory corruption could lead to crash and denial of service |
| CVE-2026-14586 | 5.9 MEDIUM | Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments |
| CVE-2026-50251 | 5.3 MEDIUM | Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush |
| CVE-2026-50045 | 5.3 MEDIUM | 'max-global-quota' reset by DNSSEC validation restarts |
| CVE-2026-56416 | 4.8 MEDIUM | Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name |
| CVE-2026-42955 | 3.7 LOW | Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-tim |
| CVE-2026-54478 | 3.7 LOW | DNS Cookie bypass when combined with proxy-protocol use |
| CVE-2026-44687 | 3.7 LOW | Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legi |
| CVE-2026-46582 | 3.7 LOW | A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply |
| CVE-2026-41637 | 3.7 LOW | Degradation of resolution service from improperly accounted client-terminated DNS-over-QUI |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Unbound
- CVE-2026-56444
Degradation of resolution service when 'discard-timeout' and - CVE-2026-56416
Possible heap buffer overflow when validator canonicalizes R - CVE-2026-55990
Packet of death for a DNSCrypt misconfigured Unbound - CVE-2026-55973
'dns-error-reporting: yes' leads to stack buffer overflow - CVE-2026-55717
'serve-expired-client-timeout' and 'response-ip' CNAME redir
Same vendor: NLnet Labs
- CVE-2026-56444
Degradation of resolution service when 'discard-timeout' and - CVE-2026-56416
Possible heap buffer overflow when validator canonicalizes R - CVE-2026-55990
Packet of death for a DNSCrypt misconfigured Unbound - CVE-2026-55973
'dns-error-reporting: yes' leads to stack buffer overflow - CVE-2026-55717
'serve-expired-client-timeout' and 'response-ip' CNAME redir
Same weakness: CWE-195
- CVE-2026-41682
pupnp: Port truncation via atoi() cast in parse_uri() allows - CVE-2026-26981
OpenEXR has heap-buffer-overflow via signed integer underflo - CVE-2025-67897
Sequoia PGP 安全漏洞 - CVE-2025-30646
Junos OS and Junos OS Evolved: Receipt of a malformed LLDP T - CVE-2025-24792
Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion
V. Comments for CVE-2026-55991
No comments yet