NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with… (CVE-2026-78227)
NLnet Labs Unbound versions 1.22.0 through 1.26.1 have a use-after-free vulnerability when compiled with DNS-over-QUIC support using '--with-libngtcp2'. This flaw occurs because the retransmission buffer in ngtcp2 holds pointers to freed memory after a client RESET_STREAM, leading to potential server crashes. The vulnerability can be triggered by a malicious actor sending specific DoQ queries without requiring privileges. The CVSS score is 6.5, indicating medium severity.
AI Analysis
Technical Summary
NLnet Labs Unbound versions 1.22.0 up to and including 1.26.1 contain a use-after-free vulnerability related to DNS-over-QUIC (DoQ) support when compiled with '--with-libngtcp2'. Each DoQ stream owns an output buffer for DNS responses, and ngtcp2's retransmission buffer keeps shallow pointers into this buffer for retransmissions. If a client sends a RESET_STREAM and withholds acknowledgments, the output buffer is freed but ngtcp2 still references it. Upon a PTO timeout, ngtcp2 attempts to retransmit using the freed buffer, causing use-after-free and potentially abnormal server termination under a query spray attack.
Potential Impact
An unauthenticated attacker able to send DNS queries over DNS-over-QUIC to a vulnerable Unbound server can trigger use-after-free conditions by manipulating stream resets and acknowledgments. This leads to retransmissions from freed memory, causing abnormal server exits (crashes). The impact is denial of service with no privilege escalation or data integrity compromise indicated.
Mitigation Recommendations
No official patch links are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, disabling DNS-over-QUIC support or avoiding compilation with '--with-libngtcp2' may mitigate exposure. Monitor vendor advisories for updates.
NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with… (CVE-2026-78227)
Description
NLnet Labs Unbound versions 1.22.0 through 1.26.1 have a use-after-free vulnerability when compiled with DNS-over-QUIC support using '--with-libngtcp2'. This flaw occurs because the retransmission buffer in ngtcp2 holds pointers to freed memory after a client RESET_STREAM, leading to potential server crashes. The vulnerability can be triggered by a malicious actor sending specific DoQ queries without requiring privileges. The CVSS score is 6.5, indicating medium severity.
CVSS v3.1
Score 6.5medium
Affected software
pkg:deb/ubuntu/unbound?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/unbound?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/unbound?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/unbound?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/unbound?arch=source&distro=jammypkg:deb/ubuntu/unbound?arch=source&distro=noblepkg:deb/ubuntu/unbound?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
NLnet Labs Unbound versions 1.22.0 up to and including 1.26.1 contain a use-after-free vulnerability related to DNS-over-QUIC (DoQ) support when compiled with '--with-libngtcp2'. Each DoQ stream owns an output buffer for DNS responses, and ngtcp2's retransmission buffer keeps shallow pointers into this buffer for retransmissions. If a client sends a RESET_STREAM and withholds acknowledgments, the output buffer is freed but ngtcp2 still references it. Upon a PTO timeout, ngtcp2 attempts to retransmit using the freed buffer, causing use-after-free and potentially abnormal server termination under a query spray attack.
Potential Impact
An unauthenticated attacker able to send DNS queries over DNS-over-QUIC to a vulnerable Unbound server can trigger use-after-free conditions by manipulating stream resets and acknowledgments. This leads to retransmissions from freed memory, causing abnormal server exits (crashes). The impact is denial of service with no privilege escalation or data integrity compromise indicated.
Mitigation Recommendations
No official patch links are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, disabling DNS-over-QUIC support or avoiding compilation with '--with-libngtcp2' may mitigate exposure. Monitor vendor advisories for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-78227
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab4be4ef7a7c54106f0a9e1
Added to database: 09/24/2026, 06:08:14 UTC
Last enriched: 09/24/2026, 06:44:39 UTC
Last updated: 09/25/2026, 03:22:02 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.