{"id":"CVE-2026-97206","kind":"vulnerability","aliases":["CVE-2026-97206"],"related":[],"title":"Unbound: DNS-over-QUIC stale pointer lets remote client crash resolver","description":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.","summary":"Unbound 1.22.0 through 1.26.1 has a lifetime bug in its DNS-over-QUIC handling: a client-triggered QUIC path migration frees a stream that a pending reply still points to, and the later dereference crashes the process. An attacker can take the resolver down by remote DoQ traffic under multi-threaded operation.","severity":"high","cvss":7.5,"epss":0.00263,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","package","resolver-operators","self-hosted","unbound"],"not_affected_if":["no-doq-listener","plain-dns-only","versions-outside-range"],"how_to_check":"- `unbound -V` to read the installed version, and confirm it is in the 1.22.0 to 1.26.1 range\n- Check whether DNS-over-QUIC is enabled in `unbound.conf` (look for `interface` on port 853 with `dot-quic` or DoQ settings)","fix":"- Upgrade Unbound to a release newer than `1.26.1`; the sources do not name the fixed version\n- Until patched, disable DNS-over-QUIC listeners if they are not needed","status":"open","published_at":"2026-10-21T09:17:08+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:16:58+00:00","updated_at":"2026-10-25T03:16:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:16:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Unbound to a release newer than `1.26.1`; the sources do not name the fixed version\n- Until patched, disable DNS-over-QUIC listeners if they are not needed","reach":"internet","title":"Unbound: DNS-over-QUIC stale pointer lets remote client crash resolver","impact":"medium","summary":"Unbound 1.22.0 through 1.26.1 has a lifetime bug in its DNS-over-QUIC handling: a client-triggered QUIC path migration frees a stream that a pending reply still points to, and the later dereference crashes the process. An attacker can take the resolver down by remote DoQ traffic under multi-threaded operation.","category":"package","nicknames":[],"who_cares":["unbound","dns","self-hosted","resolver-operators"],"confidence":0.6,"needs_auth":"no","worst_case":"remote client crashes the resolver process via stale pointer","analyst_note":"Check the NVD entry and NLnet Labs release notes for the fixed version and whether DoQ must be enabled to be exposed.","how_to_check":"- `unbound -V` to read the installed version, and confirm it is in the 1.22.0 to 1.26.1 range\n- Check whether DNS-over-QUIC is enabled in `unbound.conf` (look for `interface` on port 853 with `dot-quic` or DoQ settings)","needs_analyst":true,"not_affected_if":["no-doq-listener","plain-dns-only","versions-outside-range"],"who_is_affected":"Only deployments that accept DNS-over-QUIC from remote clients are exposed, and the flaw sits in the QUIC stream cleanup path, so resolvers that serve plain DNS or DoT only are not hit by this description. Operators running Unbound 1.22.0 through 1.26.1 with DoQ listeners and multi-threading should prioritize the upgrade. Teams that do not expose DoQ can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":3450,"output_tokens":704,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-97206':15A,18A '1.22.0':29B,86C '1.26.1':31B,92C 'attack':68B 'bug':35B,101C 'cleanup':123C,136C 'client':10A,45B,107C,115C 'client-trigg':44B,114C 'complet':148C 'contain':93C 'crash':11A,64B,157C 'cve':13A,16A 'derefer':63B,150C 'dns':3A,19B,39B,96C 'dns-over-qu':2A,38B,95C 'doq':76B,99C,106C,134C,139C 'enter':121C 'free':50B,137C 'handl':42B 'host':26B 'includ':90C 'lab':84C 'later':62B,147C 'lead':154C 'let':8A 'lifetim':34B,100C 'mesh':126C,145C 'migrat':49B,119C 'multi':80B,110C 'multi-thread':79B,109C 'nlnet':83C 'oper':23B,82B,112C 'packag':20B 'path':48B,118C 'pend':55B,144C 'point':58B 'pointer':7A,131C,153C 'process':66B 'quic':5A,41B,47B,98C,117C 'reachabl':102C 'remot':9A,75B,105C 'repli':56B,127C,146C 'resolv':12A,22B,72B 'resolver-oper':21B 'retain':129C 'self':25B 'self-host':24B 'stale':6A,152C 'still':57B,128C 'stream':52B,135C,140C 'stream/connection':122C 'take':70B 'thread':81B,111C 'traffic':77B 'trigger':46B,116C 'unbound':1A,27B,28B,85C 'version':91C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that accept DNS-over-QUIC from remote clients are exposed, and the flaw sits in the QUIC stream cleanup path, so resolvers that serve plain DNS or DoT only are not hit by this description. Operators running Unbound 1.22.0 through 1.26.1 with DoQ listeners and multi-threading should prioritize the upgrade. Teams that do not expose DoQ can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"sep@nlnetlabs.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97206","severity":null,"published_at":"2026-10-21T09:17:08+00:00","modified_at":"2026-10-22T15:22:40+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-97206","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97206","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}