{"id":"CVE-2026-97206","aliases":["AZL-109824","DEBIAN-CVE-2026-97206","EUVD-2026-107154","GHSA-jc7q-6h55-rr57","MGASA-2026-0571","UBUNTU-CVE-2026-97206","openSUSE-SU-2026:12257-1"],"status":"published","title":"DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.","description":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00334,"percentile":0.26944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-416"],"published":"2026-10-21T08:57:41Z","modified":"2026-11-11T09:41:51Z","exploits":[{"source":"pocgithub","id":"suominen/CVE-2026-97206","title":"suominen/CVE-2026-97206","date":"2026-10-22","url":"https://github.com/suominen/CVE-2026-97206"}],"fixes":[{"ecosystem":"Azure Linux:3","package":"unbound","fixed_in":["1.26.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.26.2-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.26.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-0+deb13u1"}]}],"versions":["1.22.0-2","1.22.0-2+deb13u1","1.22.0-2+deb13u2","1.22.0-2+deb13u3","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2","1.26.1-0+deb13u1","1.26.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-1"}]}],"versions":["1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2","1.26.1-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-1.mga10"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2","1.4.22-1ubuntu4.14.04.3","1.4.22-1ubuntu4.14.04.3+esm1","1.4.22-1ubuntu4.14.04.3+esm2","1.4.22-1ubuntu4.14.04.3+esm3","1.4.22-1ubuntu4.14.04.3+esm4","1.4.22-1ubuntu4.14.04.3+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1","1.5.8-1ubuntu1.1","1.5.8-1ubuntu1.1+esm1","1.5.8-1ubuntu1.1+esm2","1.5.8-1ubuntu1.1+esm3","1.5.8-1ubuntu1.1+esm4","1.5.8-1ubuntu1.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3","1.6.7-1ubuntu2.4","1.6.7-1ubuntu2.5","1.6.7-1ubuntu2.6","1.6.7-1ubuntu2.6+esm2","1.6.7-1ubuntu2.6+esm3","1.6.7-1ubuntu2.6+esm4","1.6.7-1ubuntu2.6+esm5","1.6.7-1ubuntu2.6+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3","1.9.4-2ubuntu1.4","1.9.4-2ubuntu1.5","1.9.4-2ubuntu1.6","1.9.4-2ubuntu1.8","1.9.4-2ubuntu1.9","1.9.4-2ubuntu1.11","1.9.4-2ubuntu1.11+esm1","1.9.4-2ubuntu1.11+esm2","1.9.4-2ubuntu1.11+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2","1.13.1-1ubuntu5.3","1.13.1-1ubuntu5.4","1.13.1-1ubuntu5.5","1.13.1-1ubuntu5.7","1.13.1-1ubuntu5.8","1.13.1-1ubuntu5.10","1.13.1-1ubuntu5.11","1.13.1-1ubuntu5.12","1.13.1-1ubuntu5.13","1.13.1-1ubuntu5.14","1.13.1-1ubuntu5.15","1.13.1-1ubuntu5.16","1.13.1-1ubuntu5.17"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.1-2","1.18.0-2ubuntu1","1.18.0-2ubuntu2","1.19.1-1ubuntu1","1.19.2-1ubuntu1","1.19.2-1ubuntu3","1.19.2-1ubuntu3.1","1.19.2-1ubuntu3.2","1.19.2-1ubuntu3.3","1.19.2-1ubuntu3.4","1.19.2-1ubuntu3.5","1.19.2-1ubuntu3.6","1.19.2-1ubuntu3.7","1.19.2-1ubuntu3.8","1.19.2-1ubuntu3.9","1.19.2-1ubuntu3.10","1.19.2-1ubuntu3.12"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.2-1ubuntu2","1.25.1-1ubuntu1","1.25.1-1ubuntu3","1.25.1-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.0-2ubuntu2","1.22.0-2ubuntu4","1.24.2-1ubuntu1","1.24.2-1ubuntu2","1.24.2-1ubuntu2.1","1.24.2-1ubuntu2.2","1.24.2-1ubuntu2.3","1.24.2-1ubuntu2.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-1.1"}]}],"bundled":5}],"products":[{"vendor":"nlnet labs","product":"unbound"}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-97206.txt","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97206","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jc7q-6h55-rr57"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-97206","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0571.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36568","tags":["report"]},{"url":"https://nlnetlabs.nl/projects/unbound/security-advisories/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-97206","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97206","tags":["report"]},{"url":"https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97206","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-97206","title":"DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.","description":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.","status":"published","published":"2026-10-21T08:57:41.106Z","modified":"2026-10-29T19:08:32.47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:44:07.200604Z"}],"euvd":[{"id":"EUVD-2026-107154","description":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.","status":"published","published":"2026-10-21T08:57:41Z","modified":"2026-10-29T19:08:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:15.044173Z"}],"ghsa":[{"id":"GHSA-jc7q-6h55-rr57","title":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ)...","description":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.","status":"published","published":"2026-10-21T09:30:30Z","modified":"2026-10-21T09:30:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:14:09.061875Z"}],"nvd":[{"id":"CVE-2026-97206","description":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.","status":"published","published":"2026-10-21T09:17:08.473Z","modified":"2026-10-29T19:17:29.807Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:13:02.045979Z"}],"osv":[{"id":"DEBIAN-CVE-2026-97206","description":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.","status":"published","published":"2026-10-21T09:17:08.473Z","modified":"2026-11-11T05:00:07.875137814Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T05:23:56.689465Z"},{"id":"UBUNTU-CVE-2026-97206","description":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.","status":"published","published":"2026-10-21T09:17:00Z","modified":"2026-11-11T09:41:51.042402166Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T10:03:46.098752Z"},{"id":"AZL-109824","title":"CVE-2026-97206 affecting package unbound for versions less than 1.26.2-1","description":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.","status":"published","published":"2026-10-21T09:17:08Z","modified":"2026-11-06T14:16:53.438634048Z","updated_at":"2026-11-06T14:57:15.495576Z"},{"id":"MGASA-2026-0571","title":"Updated unbound package fixes security vulnerabilities","description":"Bypass of a configured island trust anchor underneath an insecure parent\nfrom an attacker-controlled NSEC record.\nPossible insecure NXDOMAIN for non-existing records under a configured\nisland trust anchor underneath an insecure parent.\nAggregate DNS name chained pointer decompression work leads to\ndegradation of service.\nDNS-over-QUIC path-migration can lead to use-after-free on\nmulti-threaded deployments.\nPossible cache poisoning vulnerability via a cache side-channel exposed\nby 'unwanted-reply-threshold'.\n","status":"published","published":"2026-11-02T16:03:56Z","modified":"2026-11-02T16:27:56.070550968Z","updated_at":"2026-11-02T16:43:25.26575Z"},{"id":"openSUSE-SU-2026:12257-1","title":"libunbound8-1.26.2-1.1 on GA media","description":"These are all security issues fixed in the libunbound8-1.26.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:12.829074157Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}