CVE-2026-78227

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*

History

23 Sep 2026, 20:09

Type	Values Removed	Values Added
References	~~() https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt -~~	() https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt - Patch, Vendor Advisory
First Time		Nlnetlabs Nlnetlabs unbound
CPE		cpe:2.3:a:nlnetlabs:unbound::::::::

Information

Published : 2026-09-16 09:17

Updated : 2026-09-23 20:09

NVD link : CVE-2026-78227

Mitre link : CVE-2026-78227

CVE.ORG link : CVE-2026-78227

JSON object : View

Products Affected

nlnetlabs

unbound

CWE

CWE-416

Use After Free

{"id": "CVE-2026-78227", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78227", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-16T15:33:40.171223Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "sep@nlnetlabs.nl", "affectedData": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.22.0", "lessThan": "1.26.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T09:17:05.987", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt", "tags": ["Patch", "Vendor Advisory"], "source": "sep@nlnetlabs.nl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray."}], "lastModified": "2026-09-23T20:09:01.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "364266DB-748A-479E-8C04-CC78B2650414", "versionEndExcluding": "1.26.1", "versionStartIncluding": "1.22.0"}], "operator": "OR"}]}], "sourceIdentifier": "sep@nlnetlabs.nl"}