CVE-2026-78227

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.26.1

Description A use-after-free issue occurs when the software is compiled for DNS-over-QUIC (DoQ) support using the --with-libngtcp2 flag. In this configuration, each DoQ stream utilizes an output buffer for DNS responses. The ngtcp2 retransmission buffer maintains a shallow pointer to this output buffer. When a client sends a RESET STREAM, the output buffer is freed, but ngtcp2 retains the retransmission entries. A subsequent Probe Timeout (PTO) triggers ngtcp2 to re-encode the STREAM frame and copy data from the already freed buffer. An unprivileged remote actor can trigger this by querying Unbound over DoQ, withholding acknowledgments, and sending a RESET STREAM. This can result in an abnormal server exit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.