Executive brief
Unbound is a widely-used DNS resolver that can support encrypted DNS queries via HTTPS (DoH). When running with DoH enabled, a flaw in how the software manages multiple concurrent connections can cause it to crash during periods of heavy traffic or when certain network policies are applied. An attacker can trigger this crash remotely with a single crafted connection, leading to denial of service and interruption of DNS resolution for dependent services and users.
Technical details
This vulnerability is a use-after-free in Unbound's DNS-over-HTTPS handler when compiled with libnghttp2 support. The root cause lies in improper state management of DoH streams during failure scenarios: when a stream is dropped (due to RPZ policy enforcement or traffic congestion), the code incorrectly invalidates the entire DoH session rather than just the individual stream, leaving dangling pointers to other concurrent streams in the same session. The attack requires the DoH prerequisite to be satisfied (RPZ filtering enabled or sustained traffic) and can be triggered via network-reachable DoH connections without authentication. While the vulnerability does not allow arbitrary code execution due to controlled reads, a hardened allocator can detect the use-after-free and terminate the process, resulting in a denial of service. A fix is available in Unbound 1.26.1, and a patch has been released for 1.26.0.
Affected products
- NLnet Labs Unbound 1.12.0 through 1.26.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Unbound 1.26.1 released with fix