Use-After-Free Vulnerability in Unbound DNS Resolver by NLnet Labs

CVE-2026-78227

What is CVE-2026-78227?

Unbound, a DNS resolver by NLnet Labs, is susceptible to a use-after-free vulnerability when configured for DNS-over-QUIC support. This issue arises in versions 1.22.0 through 1.26.1, specifically when the software is compiled with the '--with-libngtcp2' option. In this scenario, each DoQ (DNS-over-QUIC) stream allocates an output buffer to store DNS responses while ngtcp2 maintains a shallow reference to this buffer for retransmission purposes. If a client issues a RESET_STREAM command without acknowledging the previous responses, and subsequently waits for a timeout, the output buffer gets freed even though ngtcp2 retains references to its entries. This leads to potential retransmissions using invalid memory, which could cause the server to behave abnormally or even crash, posing significant risks to network stability.

References