Unbound (1.22.0-1.26.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/unbound-1.22.0-1.26.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 11:19:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNLnet Labs Unbound: DNS-over-QUIC use-after-free (CVE-2026-97206)https://feed.craftedsignal.io/briefs/2026-10-unbound-doq-crash/Wed, 21 Oct 2026 11:19:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-unbound-doq-crash/NLnet Labs Unbound versions 1.22.0 through 1.26.1 contain a use-after-free vulnerability in the DNS-over-QUIC implementation, allowing a remote attacker to cause a service crash via QUIC path migration.NLnet Labs Unbound versions 1.22.0 through 1.26.1 are affected by a use-after-free vulnerability (CVE-2026-97206) in the DNS-over-QUIC (DoQ) handling. When configured for multi-threaded operation, a remote attacker can trigger a QUIC path migration that initiates stream and connection cleanup. Because a mesh reply retains a pointer to the DoQ stream, the cleanup process frees the memory prematurely. When the mesh reply completes, it attempts to dereference the stale pointer, resulting in a service crash.

Impact

Successful exploitation results in a Denial of Service (DoS) due to the Unbound service crashing.

Recommendation

  • Upgrade NLnet Labs Unbound to a version addressing CVE-2026-97206.
  • Review network configurations to identify instances of Unbound utilizing DNS-over-QUIC.
  • Monitor Unbound service logs and system daemon logs for repeated crash and restart events associated with DoQ activity.
]]>lowadvisory