{"advisories":[{"id":"DSA-6507-1","source":"dsa","title":"unbound security update","url":"https://lists.debian.org/debian-security-announce/2026/msg00419.html"}],"cve":"CVE-2026-78227","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[1.22.0,1.26.1)"}}],"enrichment":{"confidence":97.0,"confidence_source":"matching","scores":[{"score":97.0,"source":"matching"}]},"original":{"product":"Unbound","source":"cna","vendor":"NLnet Labs"},"product":"unbound","vendor":"nlnetlabs"}],"created":"2026-09-16T14:30:10.714529+00:00","updated":"2026-09-18T10:45:06.649756+00:00","vendors":["nlnetlabs","nlnetlabs$PRODUCT$unbound"]},"epss":{"score":0.00267},"mitre":{"cpes":[],"created":"2026-09-16T08:29:52.342000+00:00","description":"NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/78xxx/CVE-2026-78227.json","references":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt"],"title":"Use-after-free in DoQ stream output buffer on reset re-transmission","updated":"2026-09-16T15:33:54.267000+00:00","vendors":[],"weaknesses":["CWE-416"]},"nvd":{"cpes":["cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*"],"created":"2026-09-16T09:17:05.987000+00:00","description":"NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-78227.json","references":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt"],"title":null,"updated":"2026-09-23T20:09:01.923000+00:00","vendors":["nlnetlabs","nlnetlabs$PRODUCT$unbound"],"weaknesses":["CWE-416"]},"opencve":{"changes":[{"created":"2026-09-16T08:45:00+00:00","data":[{"details":{"new":"NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.","old":null},"type":"description"},{"details":{"new":"Use-after-free in DoQ stream output buffer on reset re-transmission","old":null},"type":"title"},{"details":{"added":["CWE-416"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"ce86c5d2-01bc-40bb-9103-9ab829a0d395"},{"created":"2026-09-16T12:15:00+00:00","data":[{"details":{"added":["CWE-825"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://nvd.nist.gov/vuln/detail/CVE-2026-78227","https://www.cve.org/CVERecord?id=CVE-2026-78227"],"removed":[]},"type":"references"},{"details":{"added":{},"removed":{},"updated":{"threat_severity":{"new":"Moderate","old":null}}},"type":"metrics"}],"id":"a4ec32cd-a58b-4478-8688-a2bafa8fd972"},{"created":"2026-09-16T16:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"cce6aa97-acb7-49ef-8b90-40e2991130de"},{"created":"2026-09-17T21:00:00+00:00","data":[{"details":["nlnetlabs","nlnetlabs$PRODUCT$unbound"],"type":"first_time"},{"details":{"added":["nlnetlabs","nlnetlabs$PRODUCT$unbound"],"removed":[]},"type":"vendors"}],"id":"9920a11b-214d-4b22-a6bd-61facdca247c"},{"created":"2026-09-23T20:15:00+00:00","data":[{"details":{"added":["cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"}],"id":"b52fa70a-f927-43c1-aa07-65a69be179af"}],"cpes":{"data":["cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2026-09-16T08:29:52+00:00","provider":"redhat"},"description":{"data":"NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00267},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":"Moderate","provider":"redhat"}},"references":{"data":["https://nvd.nist.gov/vuln/detail/CVE-2026-78227","https://www.cve.org/CVERecord?id=CVE-2026-78227","https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt"],"providers":["mitre","nvd","redhat"]},"title":{"data":"Use-after-free in DoQ stream output buffer on reset re-transmission","provider":"mitre"},"updated":{"data":"2026-09-23T20:09:01.923000+00:00","provider":"nvd"},"vendors":{"data":["nlnetlabs","nlnetlabs$PRODUCT$unbound"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-416","CWE-825"],"providers":["mitre","nvd","redhat"]}},"redhat":{"cpes":[],"created":"2026-09-16T08:29:52+00:00","description":"A flaw was found in Unbound. This vulnerability occurs in the DNS-over-QUIC (DoQ) stream output buffer when a client sends a RESET_STREAM, causing the output buffer to be freed while retransmission entries still point to it. A remote attacker, by querying Unbound over DoQ, withholding acknowledgments, and sending a RESET_STREAM, can trigger this flaw. This leads to retransmissions against freed memory, ultimately resulting in a denial of service due to an abnormal server exit.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"threat_severity":"Moderate"},"redhat_repo_path":"2026/CVE-2026-78227.json","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-78227","https://www.cve.org/CVERecord?id=CVE-2026-78227","https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt"],"title":"unbound: Unbound: Denial of Service via use-after-free in DoQ stream output buffer","updated":"2026-09-16T08:29:52+00:00","vendors":[],"weaknesses":["CWE-825"]},"vulnrichment":{"cpes":[],"created":"2026-09-16T08:29:52.342000+00:00","description":"NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"Use-after-free in DoQ stream output buffer on reset re-transmission","updated":"2026-09-16T15:33:44.461000+00:00","vendors":[],"vulnrichment_repo_path":"2026/78xxx/CVE-2026-78227.json","weaknesses":[]}}