What’s Vulnerable › Vulnerabilities
CVE-2026-82720: Use-after-free in DoH stream cleanup code path
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-23
- Weakness: CWE-416
Description
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.
Affected products
- NLnet Labs Unbound: from 1.12.0 before 1.26.1 — fixed in 1.26.1
How to fix
Upgrade to a fixed version: NLnet Labs Unbound 1.26.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-82720 or the next vulnerability affects your stack