---
id: "CVE-2026-97206"
kind: "vulnerability"
aliases: ["CVE-2026-97206"]
title: "Unbound: DNS-over-QUIC stale pointer lets remote client crash resolver"
severity: "high"
cvss: 7.5
epss: 0.00263
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns", "package", "resolver-operators", "self-hosted", "unbound"]
not_affected_if: ["no-doq-listener", "plain-dns-only", "versions-outside-range"]
published_at: "2026-10-21T09:17:08+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:16:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97206", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-97206", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Unbound: DNS-over-QUIC stale pointer lets remote client crash resolver

Unbound 1.22.0 through 1.26.1 has a lifetime bug in its DNS-over-QUIC handling: a client-triggered QUIC path migration frees a stream that a pending reply still points to, and the later dereference crashes the process. An attacker can take the resolver down by remote DoQ traffic under multi-threaded operation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `unbound -V` to read the installed version, and confirm it is in the 1.22.0 to 1.26.1 range
- Check whether DNS-over-QUIC is enabled in `unbound.conf` (look for `interface` on port 853 with `dot-quic` or DoQ settings)

## Fix

- Upgrade Unbound to a release newer than `1.26.1`; the sources do not name the fixed version
- Until patched, disable DNS-over-QUIC listeners if they are not needed

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97206
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-97206

## From the sources

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_