What is CVE-2026-14586?

CVE-2026-14586 is a medium-severity vulnerability in Nlnet Labs Unbound, classified under Reachable Assertion. CVSS score: 5.9/10. Published 2026-07-22.

How severe is CVE-2026-14586?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Nlnet Labs Unbound

CVE-2026-14586

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus…

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Nlnet Labs Unbound — versions 1.22.0

Weakness classification (CWE)

CWE-617 — Reachable Assertion

References

sep@nlnetlabs.nl (vendor-advisory)

Frequently asked questions

What is CVE-2026-14586?: CVE-2026-14586 is a medium-severity vulnerability in Nlnet Labs Unbound, classified under Reachable Assertion. CVSS score: 5.9/10. Published 2026-07-22.
How severe is CVE-2026-14586?: Medium severity. CVSS v3 base score is 5.9 out of 10.