CVE-2026-97206 PUBLISHED

DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

Assigner: NLnet Labs
Reserved: 14.10.2026 Published: 21.10.2026 Updated: 21.10.2026

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

compiled with DNS-over-QUIC support

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

compiled with DNS-over-QUIC support

CVSS 3.1

Product Status

Vendor	NLnet Labs
Product	Unbound
Versions	Default: unaffected affected from 1.22.0 to 1.26.2 (excl.)

Solutions

This issue is fixed starting with version 1.26.2

Credits

Kunta Chu (Tsinghua University) finder
Jianjun Chen (Tsinghua University) finder

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-97206.txt

Problem Types

CWE-416: Use After Free CWE