CVE-2026-78227: CWE-416: Use After Free in NLnet Labs Unbound
NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.
AI Analysis
Technical Summary
CVE-2026-78227 is a use-after-free vulnerability in NLnet Labs Unbound DNS resolver versions 1.22.0 up to and including 1.26.1 when compiled with DNS-over-QUIC support using '--with-libngtcp2'. The issue arises because ngtcp2's retransmission buffer holds shallow pointers to output buffers that are freed upon receiving a client RESET_STREAM. Subsequent retransmissions cause access to freed memory, leading to abnormal server termination. An attacker capable of sending DoQ queries and manipulating stream resets and acknowledgments can trigger this condition without any privileges.
Potential Impact
Successful exploitation results in use-after-free memory access causing abnormal termination of the Unbound server process, impacting availability. There is no indication of confidentiality or integrity compromise. The attack requires network access to the DoQ interface and specific interaction patterns but no privileges.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling DNS-over-QUIC support or avoiding compilation with '--with-libngtcp2' if feasible. Monitor vendor communications for patches or official mitigations.
CVE-2026-78227: CWE-416: Use After Free in NLnet Labs Unbound
Description
NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.
CVSS v3.1
Score 6.5medium
Affected software
NLnet Labs
Unbound
pkg:github/nlnetlabs/unboundRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-78227 is a use-after-free vulnerability in NLnet Labs Unbound DNS resolver versions 1.22.0 up to and including 1.26.1 when compiled with DNS-over-QUIC support using '--with-libngtcp2'. The issue arises because ngtcp2's retransmission buffer holds shallow pointers to output buffers that are freed upon receiving a client RESET_STREAM. Subsequent retransmissions cause access to freed memory, leading to abnormal server termination. An attacker capable of sending DoQ queries and manipulating stream resets and acknowledgments can trigger this condition without any privileges.
Potential Impact
Successful exploitation results in use-after-free memory access causing abnormal termination of the Unbound server process, impacting availability. There is no indication of confidentiality or integrity compromise. The attack requires network access to the DoQ interface and specific interaction patterns but no privileges.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling DNS-over-QUIC support or avoiding compilation with '--with-libngtcp2' if feasible. Monitor vendor communications for patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- NLnet Labs
- Date Reserved
- 2026-09-07T14:06:21.963Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaa578955bf5e2cf540b1f8
Added to database: 09/16/2026, 08:47:05 UTC
Last enriched: 09/16/2026, 09:02:10 UTC
Last updated: 09/16/2026, 22:11:11 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.