CVE-2026-50046

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.15.0 through 1.25.1

Description A use-after-free issue exists in the handling of DNS-over-TLS (DoT) forwarded queries. The TLS server name is tied to the lifetime of the serviced query struct but is also referenced by the waiting tcp struct. If the serviced query struct is removed from the mesh while the DoT TCP stream is still handshaking, the storage for the referenced string is freed. A subsequent error in the TLS stream leads to a read-only dereference of the freed pointer, causing a daemon crash and resulting in a denial of service. This can be triggered by a malicious actor querying records in a specific zone while placing the system under pressure to trigger the jostle logic. This requires a stub or forward zone configured for DoT with a #authname suffix on the server identification, and a transient connectivity failure to the server.

Recommendations Update NLnet Labs Unbound to a version later than 1.25.1.