Critical DNS-over-QUIC Lifetime Bug in Unbound Package
Summary
DEBIAN-CVE-2026-97206: NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. Affects unbound versions 1.17.1-2 – 1.26.2-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS resolver developed by NLnet Labs. It is designed to provide secure and efficient DNS resolution, supporting various protocols including DNS-over-QUIC (DoQ). The package is widely used in various environments for its performance and security features. However, it is susceptible to a critical vulnerability that affects its multi-threaded operation, specifically in handling DNS-over-QUIC connections.
Vulnerability Detail
The vulnerability identified as CVE-2026-97206 affects Unbound versions 1.22.0 through 1.26.1. It arises from a lifetime bug in the DNS-over-QUIC implementation, where a client-triggered QUIC path migration can lead to improper cleanup of streams. This situation allows a mesh reply to retain a pointer to a DoQ stream that has already been freed, resulting in a crash when the reply attempts to dereference this stale pointer. This vulnerability can be exploited by remote DoQ clients, potentially leading to denial of service.
How To Fix
No fixed version is published for this vulnerability.
To rectify this vulnerability, it is recommended to update the Unbound package to a patched version. Users can do this by executing the following command in their terminal:
sudo apt-get update && sudo apt-get install unbound
Ensure that you are running a version later than 1.26.1, as this version contains the necessary fixes.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable DNS-over-QUIC support in Unbound's configuration file to mitigate the risk of exploitation until a patch is applied. This can be done by setting 'doq: no' in the Unbound configuration file.
Conclusion
The CVE-2026-97206 vulnerability poses a significant risk to users of the Unbound DNS resolver, particularly those utilizing DNS-over-QUIC. It is crucial to update to a patched version or implement workarounds to ensure the security and stability of your DNS services.
See every vulnerability recorded for unbound →
FAQ
CVE-2026-97206 is a vulnerability in the Unbound DNS resolver that affects its handling of DNS-over-QUIC connections, potentially leading to crashes.
Unbound versions 1.22.0 to 1.26.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling DNS-over-QUIC support in your Unbound configuration as a temporary workaround.
More information can be found in the official CVE database and through security advisories related to Unbound.
References
Related vulnerabilities
Recent vulnerabilities recorded for unbound.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.