Executive brief
NLnet Labs Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A flaw in its DNS-over-QUIC implementation can cause the server to crash when it experiences high traffic volumes. This results in a denial-of-service, preventing users and systems from accessing websites and other internet services.
Technical details
A reachable assertion vulnerability (CWE-617) exists in Unbound when compiled with libngtcp2 for DNS-over-QUIC (DoQ) support. The root cause is the use of realtime instead of monotonic timestamps when interfacing with libngtcp2. Under conditions of high concurrency and system pressure, this discrepancy triggers an assertion failure within libngtcp2 regarding monotonic time, resulting in immediate process termination. An attacker can exploit this via network-based DoQ requests to cause a denial of service. The vulnerability is fixed in version 1.25.2.
Affected products
- NLnet Labs Unbound 1.22.0 through 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in version 1.25.2