AI analysis
NLnet Labs Unbound 1.22.0 through 1.26.1, when compiled for DNS-over-QUIC with '--with-libngtcp2', contains a use-after-free (CWE-416) in DoQ stream handling: ngtcp2's retransmission buffer keeps a shallow pointer into the per-stream output buffer holding the DNS response, and a client RESET_STREAM frees that buffer while the retransmission entries persist. When the next PTO (probe timeout) fires, ngtcp2 re-encodes the outstanding STREAM frame by copying from the freed buffer. An unauthenticated attacker who can query the resolver over DoQ triggers this simply by withholding ACKs, sending RESET_STREAM, and waiting for PTO; a spray of roughly 20 such queries can cause an abnormal server exit (denial of service), and the CVSS confidentiality score of High reflects possible leakage of freed heap memory into retransmitted packets. Only operators running Unbound 1.22.0–1.26.1 with DoQ support compiled in and enabled are affected; deployments without libngtcp2/DoQ are not exposed to this flaw. No public proof-of-concept is known and the issue is not on CISA KEV; it is also distinct from recent headlines about a separate Unbound DNSSEC validator flaw.
What to do: Upgrade Unbound to the patched release from NLnet Labs as soon as it is available (anything beyond 1.26.1 after confirming the fix in the release notes/advisory). As interim mitigations, disable DoQ listeners or rebuild without '--with-libngtcp2', and restrict DoQ access (network ACLs, firewall) to trusted clients. Check your build configuration and whether UDP/QUIC DoQ endpoints are exposed externally, and monitor resolver processes for abnormal restarts.
Affected
| NLnet Labs Unbound (DNS-over-QUIC builds, compiled with --with-libngtcp2) | 1.22.0 through and including 1.26.1 |
Estimated exposure
large≈10,000–100,000 internet-reachable DoQ-enabled Unbound resolvers (estimated) — Unbound is one of the most widely deployed open-source recursive resolvers (several hundred thousand instances visible in public DNS port-53 scans), but only the subset built with --with-libngtcp2 and serving DoQ is vulnerable, so the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.