CVE-2026-97206: DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
Other sources
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.26.2-1 - Upgrade
Upgrade
debian/unboundto a version that resolves this vulnerability.Fixed in 1.26.2-0+deb13u1Fixed in 1.26.2-1 - Upgrade
Upgrade
debian/unboundto a version that resolves this vulnerability.Fixed in 1.26.2-0+deb13u1 - Upgrade
Upgrade
debian/unboundto a version that resolves this vulnerability.Fixed in 1.26.2-1 - Upgrade
Upgrade
NLnet Labs Unboundto a version that resolves this vulnerability.Fixed in 1.26.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Unbound versions 1.22.0 through 1.26.1 are affected when DNS-over-QUIC is in use on a multi-threaded deployment. The issue is reachable remotely by a DoQ client.
What does an attacker need to exploit this?
An attacker needs network access as a DoQ client and must trigger QUIC path migration. No privileges or user interaction are required.
What is the expected impact?
The stale DoQ stream pointer can be dereferenced after cleanup, causing Unbound to crash. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.