Vulnerability in NLnet Labs Unbound

[ Description ]Official description

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4073

  Unbound: Multiple vulnerabilities Translated from German

  Risk mediumCVE-2026-50106CVE-2026-109125CVE-2026-97206+2 more CVEs

[ References ]References

• www.nlnetlabs.nl/downloads/unbound/CVE-2026-97206.txt