Threats Tagged 'cve-2026-82720'

NLnet Labs Unbound versions 1.12.0 through 1.26.0 contain a use-after-free vulnerability when compiled with DNS-over-HTTPs support using '--with-libnghttp2'. This flaw occurs during failure code paths involving dropped DoH streams, which improperly handle other streams in the same session, leading to use-after-free conditions. The vulnerability can be triggered by a single DoH connection under specific traffic conditions such as RPZ drop queries or heavy client traffic. While the use-after-free does not allow user-controlled reads or writes and leads to early function returns, it can cause process termination if a hardened allocator detects the issue, resulting in denial of service. No known exploits are reported in the wild. The CVSS 3.1 base score is 5.9 (medium severity).