Use-After-Free Vulnerability in NLnet Labs Unbound DNS Resolver

CVE-2026-82720

What is CVE-2026-82720?

NLnet Labs Unbound, versions 1.12.0 through 1.26.0, contains a use-after-free vulnerability when configured with DNS-over-HTTPs support using '--with-libnghttp2'. This vulnerability can be activated during failure scenarios, such as RPZ query drops or under high traffic conditions. A dropped DoH stream can destabilize the entire DoH session, failing to handle other simultaneous streams correctly, leading to potential memory misuse. While the impact is somewhat mitigated due to non-user-controlled reads, the risk of denial of service arises when a hardened allocator is employed, prompting premature termination of the process during use-after-free incidents.

References