{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/unbound-1.22.0-1.26.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-97206"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Unbound (1.22.0-1.26.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["NLnet Labs"],"content_html":"\u003cp\u003eNLnet Labs Unbound versions 1.22.0 through 1.26.1 are affected by a use-after-free vulnerability (CVE-2026-97206) in the DNS-over-QUIC (DoQ) handling. When configured for multi-threaded operation, a remote attacker can trigger a QUIC path migration that initiates stream and connection cleanup. Because a mesh reply retains a pointer to the DoQ stream, the cleanup process frees the memory prematurely. When the mesh reply completes, it attempts to dereference the stale pointer, resulting in a service crash.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a Denial of Service (DoS) due to the Unbound service crashing.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade NLnet Labs Unbound to a version addressing CVE-2026-97206.\u003c/li\u003e\n\u003cli\u003eReview network configurations to identify instances of Unbound utilizing DNS-over-QUIC.\u003c/li\u003e\n\u003cli\u003eMonitor Unbound service logs and system daemon logs for repeated crash and restart events associated with DoQ activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T11:19:29Z","date_published":"2026-10-21T11:19:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-unbound-doq-crash/","summary":"NLnet Labs Unbound versions 1.22.0 through 1.26.1 contain a use-after-free vulnerability in the DNS-over-QUIC implementation, allowing a remote attacker to cause a service crash via QUIC path migration.","title":"NLnet Labs Unbound: DNS-over-QUIC use-after-free (CVE-2026-97206)","url":"https://feed.craftedsignal.io/briefs/2026-10-unbound-doq-crash/"}],"language":"en","title":"CraftedSignal Threat Feed - Unbound (1.22.0-1.26.1)","version":"https://jsonfeed.org/version/1.1"}