CVE-2026-97206: DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NLnet Labs Unboundto a version that resolves this vulnerability.Fixed in 1.26.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Unbound versions 1.22.0 through 1.26.1 are affected when DNS-over-QUIC is in use on a multi-threaded deployment. The issue is reachable remotely by a DoQ client.
What does an attacker need to exploit this?
An attacker needs network access as a DoQ client and must trigger QUIC path migration. No privileges or user interaction are required.
What is the expected impact?
The stale DoQ stream pointer can be dereferenced after cleanup, causing Unbound to crash. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.