PT-2026-63391 · Nlnet · Unbound
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2 conn writev stream()' returns 'NGTCP2 ERR STREAM DATA BLOCKED', Unbound continues to call 'ngtcp2 ccerr set application error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64 t error code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2 conn write connection close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2 put uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial max stream data bidi local = 1' in its transport parameters and sending one DoQ query without ever reading the stream.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Unbound