NLnet Labs Unbound versions 1.12.0 up to and including 1.26.0 have a use-after-free vulnerability triggered when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. The issue arises in failure code paths, such as RPZ drop query or heavy traffic jostling, where a dropped DoH stream improperly affects other streams in the same session. This leads to a use-after-free condition. Although the reads are not user-controlled and the use-after-free results in early function returns, a hardened memory allocator can detect the issue and terminate the process, causing denial of service. Exploitation requires specific conditions but can be triggered with a single DoH connection and appropriate traffic.

The vulnerability can cause a denial of service by terminating the Unbound process if a hardened allocator detects the use-after-free condition. There is no impact on confidentiality or integrity as the use-after-free does not involve user-controlled reads and leads to early returns. No known exploits are reported in the wild.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider disabling DNS-over-HTTPs support or compiling without '--with-libnghttp2' if feasible to avoid triggering the vulnerability.