CVE-2026-14586
MEDIUM 5.9 ALL-YEARSIn NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 30th percentile
Impact if exploited
5.9CVSS 3.1 · MEDIUM · CNA
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-617: : Reachable Assertion
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 35 vendor product statements; 3 omitted. Read the full vendor advisory.
unbound-main@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
unbound-main@noarch as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
unbound-main@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
unbound-main@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
python3-unbound as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/python3-unbound
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
unbound as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/unbound
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
unbound-anchor as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/unbound-anchor
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
unbound-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/unbound-devel
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
unbound-libs as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/unbound-libs
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
unbound-utils as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/unbound-utils
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
unbound.src as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/unbound?arch=src
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
python3-unbound as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/python3-unbound
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
unbound as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/unbound
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
unbound-devel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/unbound-devel
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
unbound-libs as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/unbound-libs
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
unbound.src as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/unbound?arch=src
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:oci/ose-rhel-coreos-8?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-8
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9
- workaround: Disable DNS-over-QUIC (DoQ) by removing or commenting out any quic-port directives in your unbound.conf file. Restart the unbound service for the changes to take effect and prevent potential assertion crashes.
- none available: Fix deferred
unbound as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound-devel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-devel
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound-libs as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-libs
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound-python as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-python
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound.src as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound?arch=src
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-devel
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound-python as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-python
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound.src as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound?arch=src
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00python3-unbound as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/python3-unbound
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-devel
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound-libs as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound-libs
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00unbound.src as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/unbound?arch=src
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00
All CVSS metrics
- MEDIUM 5.9 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - MEDIUM 5.9 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Advisories
- https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-14586.txt CVE record · NLnet Labs · Updated 2026-07-22T13:03:53.107Z
NVD · CVE-2026-14586 · Updated 2026-10-24T13:10:00.147
Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-14586.json Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47662 EUVD · EUVD-2026-47662
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-14586 Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2506128 Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-14586 Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-14586 Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00
- https://access.redhat.com/errata/RHSA-2026:43588 Red Hat · CVE-2026-14586 · Updated 2026-09-01T12:47:29+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS