The CVE number for this vulnerability is CVE-2026-82720.


== Description
Unbound has a use-after-free vulnerability when compiled for DNS-over-HTTPs
support with '--with-libnghttp2'.
During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic),
a dropped DoH stream brings down the whole DoH session and does not account
properly for other DoH streams in the same session.
This leads to use-after-free in those code paths.

If the prerequisites are satisfied (possible RPZ drop or heavy client traffic),
a malicious actor can trigger the vulnerability with a single DoH connection
and the appropriate traffic.

Impact is limited as the reads are not user controlled and the use-after-free
leads to early returns.

However, a hardened allocator can catch the use-after-free and controllably
terminate the process resulting to denial of service.

Unbound 1.26.1 includes a fix to properly account the DoH mesh state on those
failure code paths.


== Affected products
Unbound 1.12.0 up to and including version 1.26.0.


== Mitigation

=== Downloading patched version
Unbound 1.26.1 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz

=== Applying the patch manually
For Unbound 1.26.0 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-82720.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-82720.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.26.0.


== Acknowledgments
We would like to thank Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab
for discovering and responsibly disclosing the vulnerability.