CVE-2026-55991

Description

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When -ngtcp2_conn_writev_stream()- returns -NGTCP2_ERR_STREAM_DATA_BLOCKED-, Unbound continues to call -ngtcp2_ccerr_set_application_error()- with a --1- error value. The -int- literal --1- is implicitly converted to the function-s -uint64_t error_code- parameter as -0xFFFFFFFFFFFFFFFF-. The follow-on -ngtcp2_conn_write_connection_close()- serialises that value as a QUIC variable-length integer; because -2^64-1- exceeds the 62-bit varint ceiling, -ngtcp2_put_uvarintlen()- fails -assert(n < 4611686018427387904ULL)- and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising -initial_max_stream_data_bidi_local = 1- in its transport parameters and sending one DoQ query without ever reading the stream.