In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's… (CVE-2026-50046)

In NLnet Labs Unbound versions 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS forwarded queries is tied to the lifetime of a 'serviced_query' struct but also referenced by a 'waiting_tcp' struct. If the 'serviced_query' struct is removed while the DoT TCP stream is still handshaking, the storage for the TLS server name string is freed. If the TLS stream then encounters an error, it dereferences this freed pointer in a read-only manner, causing the Unbound daemon to crash. This results in a denial of service. Exploitation requires a DoT forwarding or stub configuration with an '#authname' suffix and transient connection failures timed to trigger the vulnerable error path.

The vulnerability causes a denial of service by crashing the Unbound DNS daemon when the use-after-free condition is triggered. There is no impact on confidentiality or integrity. Exploitation requires knowledge of the target's DoT forwarding/stub configuration and precise timing of connection failures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, mitigate by avoiding configurations that combine DoT forwarding/stub zones with '#authname' suffixes, or by ensuring stable connectivity to prevent transient failures during DoT TCP handshakes.