top of page

Unbound DNS-over-QUIC Use-After-Free Vulnerability Allows Remote Denial of Service (CVE-2026-97206)

October 22nd, 2026

High

Our Cyber Threat Intelligence Unit is monitoring a high-severity use-after-free vulnerability (CVE-2026-97206) in Unbound, the open-source recursive DNS resolver developed by NLnet Labs. NLnet Labs disclosed the vulnerability on October 21, 2026, and credited Kunta Chu and Jianjun Chen of Tsinghua University with the discovery. A remote client using DNS-over-QUIC (DoQ) can trigger a QUIC path migration that frees a DoQ stream while a pending reply still references it, crashing the resolver and causing denial of service. The vulnerability affects Unbound versions 1.22.0 through 1.26.1 under multi-threaded operation, and the CVE record states that it applies when Unbound is compiled with DoQ support. No authentication or user interaction is required. At the time of writing, no reviewed source reports exploitation in the wild or linked threat actors. Organizations running affected Unbound resolvers should upgrade to version 1.26.2 or apply the NLnet Labs patch.

Technical Details

  • Threat Type: Memory safety vulnerability (use-after-free, CWE-416) leading to remote denial of service

  • Severity: High (CVSS 3.1 base score 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). NLnet Labs supplied the score as the CVE Numbering Authority, and the NVD record shows it. The NVD status is “Received,” and NVD has not yet published its own analysis.

  • CVE ID: CVE-2026-97206

  • Authentication: None required; no user interaction.

  • Threat Actors: None identified.

  • Affected Systems:

    • NLnet Labs Unbound 1.22.0 up to and including 1.26.1. DoQ support was introduced in 1.22.0.

    • Affected configuration: multi-threaded operation (NLnet Labs advisory) and builds compiled with DoQ support (CVE record).

    • Per Unbound documentation, DoQ requires compilation with libngtcp2 and is served only on interfaces configured with the QUIC port. The num-threads setting defaults to 1.

  • Exploitation Status: Not reported in the sources reviewed.

    • CISA KEV and EU KEV list no entry for CVE-2026-97206, and the ENISA EUVD shows no honeypot sensor data (ENISA EUVD, as of October 22, 2026).

    • EPSS gives a 0.26% probability of exploitation in the wild within 30 days (ENISA EUVD, GitHub Advisory Database).

  • Related Vulnerabilities:

    • CVE-2026-78227, a separate DoQ use-after-free fixed in Unbound 1.26.1, is a different vulnerability and does not address this issue.

    • Unbound 1.26.2 also fixes CVE-2026-35501, CVE-2026-50106, CVE-2026-96405 and CVE-2026-109125.

  • Disclosure Timeline: Reported by Kunta Chu on September 20, 2026. NLnet Labs shared a patch on September 29 and the reporter verified it on September 30. Fixed version 1.26.2 was released on October 21, 2026 (CVE record).

  • Attack Chain:

    • Initial Access: A remote, unauthenticated client reaches the resolver’s DoQ service.

    • Exploitation: The client triggers a QUIC path migration that enters stream and connection cleanup while a mesh reply (a pending resolver reply) still holds a pointer to the DoQ stream.

    • Memory Handling Failure: Cleanup frees the DoQ stream. When the pending mesh reply later completes, Unbound dereferences the stale pointer.

    • Result: The dereference leads to a crash and denial of service.

    • Post-Exploitation: None described. Sources report a crash only and do not describe code execution, persistence, or command and control.

Image by ThisisEngineering

Impact

  • Denial of Service: A successful trigger crashes the Unbound resolver and interrupts resolution service from that instance. CVSS rates availability impact as High.

  • Low Barrier: CVSS rates the attack as remote, low complexity, with no privileges and no user interaction required.

  • Confidentiality and Integrity: CVSS rates both as None. No source reports code execution or data exposure.

  • Configuration-Dependent Exposure: NLnet Labs states the vulnerability is reachable under multi-threaded operation, and the CVE record states it applies when Unbound is compiled with DoQ support.

  • Downstream Packages: Debian’s security tracker lists a fixed package only in unstable (1.26.2-1). It lists trixie (1.22.0 and 1.26.1 builds) and forky (1.26.1-1) as vulnerable. It also lists bookworm (1.17.1 builds) as vulnerable, although 1.17.1 predates the affected range stated by NLnet Labs.

  • SUSE: SUSE rates the issue important, lists its status as New, and shows the unbound package as under analysis across its products, with no fix listed as of October 22, 2026.

Detection Method

  • No source reviewed publishes detection signatures, log indicators or exploitation telemetry for CVE-2026-97206, and no source identifies a confirmed indicator of exploitation. NLnet Labs describes the observable effect as a crash.

  • To identify exposure, confirm the installed Unbound version falls between 1.22.0 and 1.26.1 (NLnet Labs advisory), whether the build includes DoQ support (CVE record), and whether the resolver runs more than one thread. Unbound documentation lists num-threads (default 1) and quic-port as the relevant settings.

  • Unbound documentation reports DoQ query volume in the num.query.quic statistic and QUIC memory use in mem.quic, which show whether a resolver is serving DoQ traffic.

Indicators of Compromise

No IOCs available.

mix of red, purple, orange, blue bubble shape waves horizontal for cybersecurity and netwo

Recommendations

  • Upgrade to Unbound 1.26.2, which fixes the vulnerability (NLnet Labs advisory and CVE record).

  • If an upgrade is not possible, apply the NLnet Labs patch to the Unbound source directory with patch -p1 and run make install (NLnet Labs CVE-2026-97206 text file).

  • A minimal patch (patch_CVE-2026-97206.diff) and a complete patch with code improvements and tests (patch_CVE-2026-97206_with.diff) are available.

  • NLnet Labs states both were tested on Unbound 1.26.1.

  • A combined patch covering all fixes in the 1.26.2 security release is also available from NLnet Labs.

  • NLnet Labs lists upgrading or patching as the solution, and the CVE record lists no workarounds.

Conclusion

CVE-2026-97206 is a High-severity use-after-free vulnerability in Unbound’s DNS-over-QUIC handling that allows a remote, unauthenticated client to crash a multi-threaded resolver through QUIC path migration. No exploitation or linked threat actors are reported in the sources reviewed. Organizations running Unbound 1.22.0 through 1.26.1 with DoQ support should upgrade to 1.26.2 or apply the NLnet Labs patch.

bottom of page