NLnet Labs Unbound: DNS-over-QUIC use-after-free (CVE-2026-97206)
NLnet Labs Unbound versions 1.22.0 through 1.26.1 contain a use-after-free vulnerability in the DNS-over-QUIC implementation, allowing a remote attacker to cause a service crash via QUIC path migration.
CVE search metadata
CVE search record: CVE-2026-97206. Severity: high. CVSS: 7.5. KEV: no. Product: Unbound (1.22.0-1.26.1). Brief: NLnet Labs Unbound: DNS-over-QUIC use-after-free (CVE-2026-97206). Brief link: https://feed.craftedsignal.io/briefs/2026-10-unbound-doq-crash/
Triage facts
Revision 1- Applicability
- Unbound (1.22.0-1.26.1)
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 21, 11:19 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
NLnet Labs Unbound versions 1.22.0 through 1.26.1 are affected by a use-after-free vulnerability (CVE-2026-97206) in the DNS-over-QUIC (DoQ) handling. When configured for multi-threaded operation, a remote attacker can trigger a QUIC path migration that initiates stream and connection cleanup. Because a mesh reply retains a pointer to the DoQ stream, the cleanup process frees the memory prematurely. When the mesh reply completes, it attempts to dereference the stale pointer, resulting in a service crash.
Impact
Successful exploitation results in a Denial of Service (DoS) due to the Unbound service crashing.
Recommendation
- Upgrade NLnet Labs Unbound to a version addressing CVE-2026-97206.
- Review network configurations to identify instances of Unbound utilizing DNS-over-QUIC.
- Monitor Unbound service logs and system daemon logs for repeated crash and restart events associated with DoQ activity.
Immediate actions
Patch Unbound to the latest version covering CVE-2026-97206
Mitigations
Disable DNS-over-QUIC if not required for business operations until patching is completed
CVE-2026-97206