The CVE number for this vulnerability is CVE-2026-97206.


== Summary
Unbound contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ
client under multi-threaded operation.

A client-triggered QUIC path migration can enter stream/connection cleanup
while a mesh reply still retains a pointer to the DoQ stream.
Cleanup frees the DoQ stream and when the pending mesh reply later completes it
dereferences a stale pointer leading to a crash.

Unbound 1.26.2 includes a fix to properly look up the DoQ stream and safely
remove the mesh state reference.


== Affected products
Unbound 1.22.0 up to and including version 1.26.1.


== Mitigation

=== Downloading patched version
Unbound 1.26.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.2.tar.gz

=== Applying the patch manually
For Unbound 1.26.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-97206_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-97206_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-97206.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.26.1.


== Acknowledgments
We would like to thank Kunta Chu and Jianjun Chen from Tsinghua University for
discovering and responsibly disclosing the vulnerability.