Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-22 | 1 | Disclosure1 |
| 2026-07-24 | 1 | General1 |
【注意喚起】Unboundの脆弱性情報が公開されました（CVE-2026-14586、他23件） https://jprs.jp/tech/security/2026-07-24-unbound.html
Post summary
A notice announcing that vulnerability information for Unbound (CVE-2026-14586 and 23 additional CVEs) has been published.
CVE-2026-14586 Medium DoS CVE-2026-32665 High DoS CVE-2026-40691 High DoS CVE-2026-41637 Low DoS CVE-2026-42955 Low CVE-2026-40622（幽霊ドメイン名）の追加修正 CVE-2026-44621 Medium DoS CVE-2026-44687 Low DoS（存在するドメイン名を存在しないと誤認させる） CVE-2026-44690 High キャッシュポイズニング CVE-2026-46582 Low キャッシュポイズニング CVE-2026-50045 Medium 外部へのDoS CVE-2026-50046 Medium DoS CVE-2026-50243 Medium DNSSEC検証のバイパス CVE-2026-50248 Medium DNSSEC Bogusでもゾーン転送の接続先にしてしまう CVE-2026-50251 Medium 外部からの意図的なキャッシュクリアによるDoS CVE-2026-50252 Medium UDPソースポートを外部から推測可能（キャッシュポイズニング） CVE-2026-52863 Medium DoS CVE-2026-54478 Low DNSクッキーの無力化 CVE-2026-55708 Low ローカルな名前を外部に問い合わせてしまう（情報流出） CVE-2026-55717 Medium DoS CVE-2026-55973 High DoS CVE-2026-55990 Medium DoS CVE-2026-55991 Medium DoS CVE-2026-56416 Medium DoS CVE-2026-56444 Medium DoS
Post summary
The text presents a disclosure list of multiple CVEs with severity ratings and brief vulnerability type descriptions, lacking PoC links, exploit code, patches, or active exploitation claims.