CVE-2026-14586

{
  "id": "CVE-2026-14586",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-22T14:17:15.020",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces."
    },
    {
      "lang": "es",
      "value": "En NLnet Labs Unbound 1.22.0 hasta la versión 1.25.1 inclusive, en entornos DNS-over-QUIC, con alta concurrencia y bajo presión, una aserción en libngtcp2 sobre marcas de tiempo monotónicas podría activarse y resultar en la terminación del servidor y, por lo tanto, en denegación de servicio. Al interactuar con libngtcp2, para el soporte de DNS-over-QUIC en Unbound, se espera que utilice tiempo monotónico. Unbound estaba usando tiempo real en su lugar, y en entornos DoQ con alta concurrencia y bajo presión, una aserción en libngtcp2 para la marca de tiempo QUIC se activaría y terminaría el servidor. Esta vulnerabilidad requiere que Unbound sea compilado con soporte DoQ (’--with-libngtcp2’) y que el ’quic-port’ sea configurado para las interfaces de escucha."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NLnet Labs",
          "product": "Unbound",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.22.0",
              "lessThan": "1.25.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T14:32:40.727677Z",
          "id": "CVE-2026-14586",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-617"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-14586.txt",
      "source": "[email protected]"
    }
  ]
}