Unbound 1.26.2 fixes high-severity DoQ use-after-free
CVE-2026-97206 can cause a use-after-free during DoQ path migration on multi-threaded Unbound deployments.
58
Vulnerability1 · 1 read
CVE-2026-97206
Use-after-free crash in multi-threaded Unbound DoQ
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
NLnet Labs Unbound 1.22.0 through 1.26.1 has a DNS-over-QUIC lifetime bug when running multi-threaded. A remote DoQ client can trigger QUIC path migration so stream cleanup frees a DoQ stream while a mesh reply still holds a pointer to it. When that reply later finishes, the stale pointer is used and the resolver crashes, denying service. Only multi-threaded Unbound instances that accept DoQ are affected.
What to do: Upgrade Unbound to 1.26.2, which addresses this issue.
| Product | Affected | Fixed in |
|---|---|---|
| NLnet Labs Unbound | 1.22.0 up to and including 1.26.1 | 1.26.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H