Quick answers
- Is CVE-2026-82720 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82720 being exploited in the wild.
- How severe is CVE-2026-82720?
- Medium severity, with a CVSS score of 5.9, published 16 September 2026.
- Which products and versions are affected?
- NLnet Labs Unbound 1.12.0 through 1.26.0.
- Is there a fix for CVE-2026-82720?
- A patch was published on 2026-09-16: Unbound 1.26.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82720 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-82720?
- Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a use-after-free in Unbound's DNS-over-HTTPS handler when compiled with libnghttp2 support. The root cause lies in improper state management of DoH streams during failure scenarios: when a stream is dropped (due to RPZ policy enforcement or traffic congestion), the code incorrectly invalidates the entire DoH session rather than just the individual stream, leaving dangling pointers to other concurrent streams in the same session. The attack requires the DoH prerequisite to be satisfied (RPZ filtering enabled or sustained traffic) and can be triggered via network-reachable DoH connections without authentication. While the vulnerability does not allow arbitrary code execution due to controlled reads, a hardened allocator can detect the use-after-free and terminate the process, resulting in a denial of service. A fix is available in Unbound 1.26.1, and a patch has been released for 1.26.0.
Affected products
- NLnet Labs Unbound 1.12.0 through 1.26.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Unbound 1.26.1 released with fix