Skip to content
Fencer Vulns
medium 6.5

CVE-2026-78227 json

Use-after-free in DoQ stream output buffer on reset re-transmission

published 2026-09-16 54 d ago modified 2026-09-23 46 d ago also EUVD-2026-80288

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.

Patch / fix

  • NLnet Labs Unbound 1.26.1
  • unbound Debian 13 1.26.1-0+deb13u1
  • unbound Debian 14 1.26.1-1

debian advisories DEBIAN-CVE-2026-78227

  • unbound hummingbird 1 1.26.1-1.hum1
  • unbound-libs hummingbird 1 1.26.1-1.hum1
  • unbound-munin hummingbird 1 1.26.1-1.hum1
  • unbound-utils hummingbird 1 1.26.1-1.hum1
  • unbound-anchor hummingbird 1 1.26.1-1.hum1
  • unbound-dracut hummingbird 1 1.26.1-1.hum1
  • python3-unbound hummingbird 1 1.26.1-1.hum1

red hat advisories RHSA-2026:68590

  • unbound Linux Micro 6.1 1.26.1-slfo.1.1_1.1
  • unbound SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +6 more 1.26.1-150100.10.31.1
  • unbound SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Package Hub 15 SP7 +1 more 1.26.1-150600.23.24.1
  • unbound SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 1.26.1-160000.1.1
  • unbound Linux Micro 6.0 1.26.1-159998.1.1

suse advisories SUSE-SU-2026:24376-1SUSE-SU-2026:4624-1SUSE-SU-2026:4620-1SUSE-SU-2026:24128-1SUSE-SU-2026:24226-1SUSE-SU-2026:24135-1

  • unbound openSUSE Leap 16.0 1.26.1-160000.1.1
  • unbound openSUSE Tumbleweed 1.26.1-1.1

opensuse advisories openSUSE-SU-2026:22082-1openSUSE-SU-2026:11930-1

  • unbound Azure Linux 3.0 1.26.1-1

azure linux advisories AZL-101703

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-78227 updated cvss 5.9

unbound: Unbound: Denial of Service via use-after-free in DoQ stream output buffer

  • Red Hat Hardened Images unbound 1.26.1-1.hum1, unbound-libs 1.26.1-1.hum1, unbound-munin 1.26.1-1.hum1, unbound-utils 1.26.1-1.hum1, unbound-anchor 1.26.1-1.hum1, unbound-dracut 1.26.1-1.hum1, +1 more
    fixed: vendor fix “To mitigate this do not set quic-port unless DNS-over-QUIC is required. If it is enabled, allow it only from trusted clients.” RHSA-2026:68590
  • Red Hat Enterprise Linux 6 unbound, unbound-libs, unbound-python Red Hat Enterprise Linux 7 unbound, unbound-libs, unbound-python Red Hat Enterprise Linux 8 unbound, unbound-libs, python3-unbound Red Hat Enterprise Linux 9 unbound, unbound-libs, unbound-dracut, python3-unbound Red Hat Enterprise Linux 10 unbound Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    +1 more products
    Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
54 d ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

Affected products

  • NLnet Labs Unbound

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.