Live › vulnerability › CVE-2026-97206
Go to dashboardUnbound 1.22.0 through 1.26.1 has a lifetime bug in its DNS-over-QUIC handling: a client-triggered QUIC path migration frees a stream that a pending reply still points to, and the later dereference crashes the process. An attacker can take the resolver down by remote DoQ traffic under multi-threaded operation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only deployments that accept DNS-over-QUIC from remote clients are exposed, and the flaw sits in the QUIC stream cleanup path, so resolvers that serve plain DNS or DoT only are not hit by this description. Operators running Unbound 1.22.0 through 1.26.1 with DoQ listeners and multi-threading should prioritize the upgrade. Teams that do not expose DoQ can skip it.
No product ranges from the sources yet.
unbound -V to read the installed version, and confirm it is in the 1.22.0 to 1.26.1 rangeunbound.conf (look for interface on port 853 with dot-quic or DoQ settings)1.26.1; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.
This page as .md · .json · in your agent: get_signal("CVE-2026-97206")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.