CVE-2026-97206: 
Unbound vulnerability analysis and mitigation

CVE-2026-97206 is a use-after-free (UAF) vulnerability in NLnet Labs Unbound DNS resolver affecting versions 1.22.0 through 1.26.1 inclusive. The flaw resides in the DNS-over-QUIC (DoQ) implementation and is triggered by a remote client initiating QUIC path migration under multi-threaded operation, ultimately causing a service crash. It was published on October 21, 2026, with a patch available in version 1.26.2. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, NLnet Labs Advisory).

The root cause is a memory lifetime management error classified as CWE-416 (Use After Free). During multi-threaded operation, a client-triggered QUIC path migration causes stream/connection cleanup to execute while a mesh reply still holds a live pointer to the DoQ stream object. The cleanup routine frees the DoQ stream, and when the pending mesh reply subsequently completes, it dereferences the now-stale pointer, causing an invalid memory access and crash. No authentication or special privileges are required — any remote DoQ client can trigger the race condition by initiating path migration at the appropriate moment (GitHub Advisory, NLnet Labs Advisory).

Successful exploitation results in a crash of the Unbound DNS resolver process, causing a complete denial of service for all DNS resolution handled by the affected instance. Because Unbound is commonly deployed as a recursive resolver for networks or as a validating resolver in security-sensitive environments, an outage can disrupt all dependent services relying on DNS. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue with no evidence of code execution potential (GitHub Advisory).

As of the disclosure date (October 21, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target Unbound instance to have DoQ enabled and to be operating in multi-threaded mode, which limits the attack surface to deployments with those specific configurations (GitHub Advisory, NLnet Labs Advisory).

1. Reconnaissance: Identify Unbound DNS resolver instances with DNS-over-QUIC (DoQ) enabled, typically listening on UDP port 853. Tools such as Shodan or Censys can be used to locate publicly exposed DoQ endpoints.
2. Establish DoQ connection: Connect to the target Unbound instance using a DoQ-capable client (e.g., a custom QUIC library or modified DNS client) to initiate a valid DNS-over-QUIC session.
3. Submit a DNS query: Send a DNS query over the DoQ connection that will require non-trivial resolver processing (e.g., a query requiring upstream recursive resolution), causing a mesh reply to be queued internally while the DoQ stream pointer is retained.
4. Trigger QUIC path migration: While the mesh reply is pending, initiate a QUIC path migration from the client side (e.g., by changing the source IP/port), causing Unbound's multi-threaded cleanup routines to free the DoQ stream object.
5. Induce crash: When the pending mesh reply completes and attempts to dereference the now-freed DoQ stream pointer, Unbound crashes due to the use-after-free condition, resulting in a denial of service (GitHub Advisory, NLnet Labs Advisory).

• Process: Unexpected termination or crash of the unbound process; crash dumps or core files generated by the Unbound service.
• Logs: Segmentation fault or invalid memory access errors in system logs (e.g., /var/log/syslog, /var/log/messages) attributed to the unbound process; Unbound log entries showing abrupt connection termination or internal errors related to DoQ stream handling.
• Network: Repeated DoQ (UDP/853) connection attempts from the same source IP, particularly with path migration events (source address/port changes mid-session); unusual QUIC traffic patterns targeting the resolver.
• Availability: Sudden DNS resolution failures for all clients served by the affected Unbound instance, consistent with a process crash rather than a gradual degradation.

The primary remediation is to upgrade NLnet Labs Unbound to version 1.26.2 or later, which contains the fix for this use-after-free vulnerability (NLnet Labs Advisory, GitHub Advisory). If immediate patching is not feasible, operators should consider disabling DNS-over-QUIC (DoQ) in the Unbound configuration to eliminate the attack surface entirely. Alternatively, restricting DoQ access to trusted client IP ranges via firewall rules or Unbound's access control lists can reduce exposure until the patch is applied.