Unbound 1.26.2 fixes high-severity DoQ use-after-free
Original title: Unbound: 1.26.2 addresses multiple CVE items
CVE-2026-97206 can cause a use-after-free during DoQ path migration on multi-threaded Unbound deployments.
NLnet Labs released Unbound 1.26.2 on October 21 as a security update for several vulnerabilities. The only flaw described in the notice is CVE-2026-97206, rated high, in which DNS-over-QUIC path migration can lead to a use-after-free on multi-threaded deployments. No exploitation status is given.
Unconfirmed: The notice says several vulnerabilities were fixed, but only CVE-2026-97206 is described in the available text.
- The security release is Unbound 1.26.2, issued October 21.
- CVE-2026-97206 is rated high by the Unbound maintainers.
- The bug affects multi-threaded deployments using DoQ path migration.
Impact: use-after-free via DoQ path migration
| Product | Affected | Fixed in |
|---|---|---|
| NLnet Labs Unbound | — | 1.26.2 |
- 1.Upgrade Unbound to 1.26.2.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97206 | Use-after-free crash in multi-threaded Unbound DoQ | 7.5 | — |
From the original article
Posted by Yorgos Thessalonikefs on Oct 21 Hi there, https://community. nlnetlabs. nl/t/unbound-1-26-2-released/3495) Several vulnerabilities were found in Unbound.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.