Is CVE-2026-78227 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78227 being exploited in the wild.

How severe is CVE-2026-78227?

Medium severity, with a CVSS score of 6.5, published 16 September 2026.

Which products and versions are affected?

NLnet Labs Unbound 1.22.0 up to and including 1.26.0.

Is there a fix for CVE-2026-78227?

A patch was published on 2026-09-16: Fixed in Unbound 1.26.1; patch available for 1.26.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78227 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-78227?

Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78227: NLnet Labs Unbound use-after-free in DNS-over-QUIC

CVE-2026-78227 · Severity: medium · CVSS 6.5 · Published 2026-09-16

Unbound is a widely-used DNS resolver that supports encrypted DNS queries over QUIC. A use-after-free vulnerability in the DoQ implementation allows an unauthenticated remote attacker to crash the resolver by sending specially crafted DNS queries with stream resets and timing manipulation. An affected resolver may become unavailable, disrupting DNS resolution for all users relying on it.

Technologies: NLnet Labs Unbound. Vendors: NLnet Labs.

Quick answers

Is CVE-2026-78227 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78227 being exploited in the wild.
How severe is CVE-2026-78227?: Medium severity, with a CVSS score of 6.5, published 16 September 2026.
Which products and versions are affected?: NLnet Labs Unbound 1.22.0 up to and including 1.26.0.
Is there a fix for CVE-2026-78227?: A patch was published on 2026-09-16: Fixed in Unbound 1.26.1; patch available for 1.26.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78227 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-78227?: Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in Unbound versions 1.22.0 through 1.26.0 when compiled with DNS-over-QUIC support (--with-libngtcp2). The bug occurs in the interaction between Unbound's output buffering and ngtcp2's retransmission buffer management: ngtcp2 maintains shallow pointers into the output buffer for potential STREAM frame retransmission, but when a client sends RESET_STREAM, Unbound frees the output buffer while ngtcp2 still holds retransmission entries referencing it. A subsequent Probe Timeout (PTO) triggers ngtcp2 to re-encode and copy from the freed memory. An attacker with network access can exploit this by withholding ACKs, sending RESET_STREAM, and waiting for PTO timeout—no authentication or special privileges required. The vulnerability leads to memory corruption and server crash under moderate query load (confirmed under a 20-query spray). Unbound 1.26.1 and later include a fix that shuts down the write side on RESET_STREAM, causing ngtcp2 to drop STREAM frames before buffer deallocation.

Affected products

NLnet Labs Unbound 1.22.0 up to and including 1.26.0

Timeline

2026-09-16: disclosed
2026-09-16: patched: Fixed in Unbound 1.26.1; patch available for 1.26.0

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.