CVE-2026-97206
DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
- Published
- Oct 21, 2026
- Updated
- Oct 29, 2026
- Assigning CNA
- NLnet Labs
- Evidence observed
- Nov 4, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLow · next 30 days
- Percentile
- 26.8%
- Model date
- Nov 4, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.
Sources
- CVE-2026-97206Informational
Static Hugo tracker site recording per-distribution patch status for the five Unbound 1.26.2 vulnerabilities, led by a DNS-over-QUIC use-after-free, with version and advisory data.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.