All vulnerabilities
CVE-2026-97206

Unbound: DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

NLnet Labs Unbound
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.26.2Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 21 Oct 2026, 08:57 UTCPublishedCVE List
  2. 22 Oct 2026, 07:12 UTCExploit code publicGitHub proof-of-concept repositories

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 2

2 outlets mention it. Reports are not confirmation; each links to its source.

Description

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

Text from CVE List

Affected versions 1

  • Unboundaffected: 1.22.0 before 1.26.2CVE List

References 1