Executive brief
Unbound is a widely-used DNS resolver that supports encrypted DNS queries over QUIC. A use-after-free vulnerability in the DoQ implementation allows an unauthenticated remote attacker to crash the resolver by sending specially crafted DNS queries with stream resets and timing manipulation. An affected resolver may become unavailable, disrupting DNS resolution for all users relying on it.
Technical details
A use-after-free vulnerability exists in Unbound versions 1.22.0 through 1.26.0 when compiled with DNS-over-QUIC support (--with-libngtcp2). The bug occurs in the interaction between Unbound's output buffering and ngtcp2's retransmission buffer management: ngtcp2 maintains shallow pointers into the output buffer for potential STREAM frame retransmission, but when a client sends RESET_STREAM, Unbound frees the output buffer while ngtcp2 still holds retransmission entries referencing it. A subsequent Probe Timeout (PTO) triggers ngtcp2 to re-encode and copy from the freed memory. An attacker with network access can exploit this by withholding ACKs, sending RESET_STREAM, and waiting for PTO timeout—no authentication or special privileges required. The vulnerability leads to memory corruption and server crash under moderate query load (confirmed under a 20-query spray). Unbound 1.26.1 and later include a fix that shuts down the write side on RESET_STREAM, causing ngtcp2 to drop STREAM frames before buffer deallocation.
Affected products
- NLnet Labs Unbound 1.22.0 up to and including 1.26.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in Unbound 1.26.1; patch available for 1.26.0