CVE-2026-97206

Awaiting Analysis Awaiting Analysis - Queue

Unbound DoQ Lifetime Bug Leads to Remote Crash

Publication date: 2026-10-21

Last updated on: 2026-10-29

Assigner: NLnet Labs

Description

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-97206

EUVD

EUVD-2026-107154

Affected Vendors & Products

Vendor	Product	Version / Range
NLnet Labs	Unbound	1.22.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a DNS-over-QUIC (DoQ) lifetime bug in NLnet Labs Unbound versions 1.22.0 to 1.26.1. It occurs in multi-threaded setups when a remote DoQ client triggers a QUIC path migration. This causes cleanup to free a DoQ stream while a mesh reply still holds a pointer to it. Later, when the mesh reply completes, it dereferences the freed pointer, leading to a crash.

Detection Guidance

Detection primarily involves checking the Unbound version. Run 'unbound -V' to verify if your version is between 1.22.0 and 1.26.1. Monitor logs for crashes or errors related to DoQ operations.

Impact Analysis

This vulnerability can cause Unbound DNS servers to crash when processing DoQ requests under multi-threaded operation. A remote attacker could exploit this to disrupt DNS resolution services, leading to downtime or degraded performance for users relying on the affected Unbound server.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical flaw in DNS-over-QUIC handling that causes crashes. Compliance risks would arise only if the crash leads to service disruptions affecting data processing or availability.

Mitigation Strategies

Upgrade to Unbound 1.26.2 or apply the manual patch for 1.26.1. If using 1.26.1, download the patch, apply it to the source directory, then run 'make install'. Alternatively, disable DoQ if not required.

Hi! I’m here to help you understand CVE-2026-97206. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...