CVE-2026-97206

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.26.1

Description A lifetime bug exists in DNS-over-QUIC (DoQ) when operating in multi-threaded mode. A remote DoQ client can trigger a QUIC path migration, causing the system to enter stream or connection cleanup while a mesh reply still holds a pointer to the DoQ stream. This results in a use-after-free condition where the cleanup process frees the DoQ stream, and the subsequent completion of the pending mesh reply dereferences a stale pointer, leading to a crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.