CVE-2026-82720

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.12.0 through 1.26.0

Description A use-after-free issue occurs when the software is compiled for DNS-over-HTTPs (DoH) support using the --with-libnghttp2 flag. During failure code paths, such as an RPZ drop query or jostle caused by heavy traffic, a dropped DoH stream can terminate the entire DoH session without properly accounting for other active streams in that same session. A malicious actor can trigger this condition with a single DoH connection and specific traffic, provided the prerequisites are met. While the impact is limited because reads are not user-controlled and typically result in early returns, a hardened allocator may detect the use-after-free and terminate the process, leading to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.