Is CVE-2026-97206 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97206 being exploited in the wild.

How severe is CVE-2026-97206?

High severity, with a CVSS score of 7.5, published 21 October 2026.

Which products and versions are affected?

NLnet Labs Unbound 1.22.0 through 1.26.1.

How is CVE-2026-97206 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-97206?

Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97206: NLnet Labs Unbound use-after-free in DNS-over-QUIC stream cleanup

CVE-2026-97206 · Severity: high · CVSS 7.5 · Published 2026-10-21

Unbound is a DNS resolver that some organizations use to resolve domain names on their networks. A remote attacker can crash the DNS resolver by triggering a QUIC path migration that causes the resolver to free a stream while a mesh reply still holds a pointer to it, leading to a use-after-free crash. This can disrupt DNS resolution and cause service outages.

Technologies: NLnet Labs Unbound. Vendors: NLnet Labs.

Quick answers

Is CVE-2026-97206 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97206 being exploited in the wild.
How severe is CVE-2026-97206?: High severity, with a CVSS score of 7.5, published 21 October 2026.
Which products and versions are affected?: NLnet Labs Unbound 1.22.0 through 1.26.1.
Is there a fix for CVE-2026-97206?: Yes: fixed in Unbound 1.26.2. Until then: Apply the patch manually using the patch files provided by NLnet Labs (patch_CVE-2026-97206_with.diff or patch_CVE-2026-97206.diff for Unbound 1.26.1), or upgrade to Unbound 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97206 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-97206?: Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Unbound 1.26.2

Apply the patch manually using the patch files provided by NLnet Labs (patch_CVE-2026-97206_with.diff or patch_CVE-2026-97206.diff for Unbound 1.26.1), or upgrade to Unbound 1.26.2 or later.

Technical details

The vulnerability is a use-after-free in Unbound's DNS-over-QUIC (DoQ) implementation under multi-threaded operation. An attacker can trigger QUIC path migration to cause stream/connection cleanup while a mesh reply retains a stale pointer to the DoQ stream; when the reply completes, dereferencing the freed pointer crashes the process. The attack is remotely reachable by any DoQ client and does not require authentication.

Affected products

NLnet Labs Unbound 1.22.0 through 1.26.1

Timeline

2026-10-21: disclosed

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-97206.txt

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.