CVE-2026-97206CWE-416

CVE-2026-97206

High · published October 21, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-416 · Use After Free
Published
2026-10-21T13:17Z
References (1)
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-97206.txt · [email protected]
EPSS history
Timeline
  • 22 OCT 03:36Z
    EPSS moved — → 0%
    epss
  • 21 OCT 08:57Z
    DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
    cvelistv5
  • 21 OCT 08:57Z
    DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
    cvelistv5