CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission
NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESETSTREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESETSTREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Unboundto a version that resolves this vulnerability.Fixed in 1.26.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Unbound versions 1.22.0 through 1.26.1 are affected only when built with DNS-over-QUIC support using '--with-libngtcp2'. An attacker must be able to send queries to the server over DoQ.
What does an attacker need to do to trigger the issue?
No privileges or user interaction are required. The attacker queries over DoQ, withholds ACKs, sends RESET_STREAM, and waits for a PTO timeout so ngtcp2 retransmits from the freed output buffer.
What is the practical impact?
The issue causes retransmissions to read freed memory and can eventually terminate the server abnormally. The described server exit occurs under a 20-query spray.