Zero Radar
← feed
HighVulnerabilityCVE-2026-97206updated 25 Oct 2026, 13:32 UTC

Unbound DNS resolver can crash when DNS-over-QUIC clients switch connections

Unbound is a program that answers DNS lookups for a network. A specially crafted connection change from a remote client can make it crash, which stops DNS service for everyone who uses it.

Fix availableOfficial, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?Not knownNo attacks reported so far
Fix available?YesUpdate to a fixed Unbound release as published by NLnet Labs and Debian (DSA-6581-1); exact fixed version not stated in the provided material. · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote clientConnects to DoQ port
  2. 2Path migrationClient changes QUIC connection path
  3. 3Stream freedCleanup frees stream still referenced
  4. 4Stale pointer usedPending reply dereferences freed memory
  5. ResultUnbound crashes, DNS service stops

What happened

In Unbound 1.22.0 through 1.26.1 running multi-threaded with DNS-over-QUIC (DoQ), a client-triggered QUIC path migration frees a DoQ stream while a pending mesh reply still points to it, causing a use-after-free and crash.

Why it is dangerous: A remote, unauthenticated client can crash the resolver (denial of service), taking down DNS resolution for the network it serves.

Are you affected?

You are affected if you run Unbound 1.22.0 through 1.26.1 with DNS-over-QUIC enabled on a multi-threaded deployment.

Unbound 1.22.0 up to and including 1.26.1 (multi-threaded deployments with DoQ)

What to do

  1. Update Unbound to a fixed version (check the Debian DSA-6581-1 package for your release)
  2. If you cannot update immediately, disable DNS-over-QUIC or run Unbound single-threaded as a temporary workaround
  3. Restart Unbound after updating and confirm it stays running under normal DNS load

Timeline

  1. 21 Oct 2026, 09:17 UTC
    Publicly disclosed
  2. 21 Oct 2026, 09:17 UTC
    Reported by NVD · NVD
  3. 23 Oct 2026, 00:00 UTC
    Reported by Debian DSA · Debian DSA

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-97206
CVSS
7.5 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 09:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Unbound DNS resolver can crash when DNS-over-QUIC clients switch connections · Zero Radar