CVE catalog

CVE-2026-78227

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that hol

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianunboundsid1.26.2-1fixed
Debianunboundforky1.26.2-1fixed
Debianunboundtrixie1.22.0-2+deb13u3vulnerable
Debianunboundtrixie-security1.26.2-0+deb13u1fixed
Debianunboundbookworm1.17.1-2+deb12u4vulnerable
Debianunboundbookworm-security1.17.1-2+deb12u3vulnerable
CpeunboundNot reported1.26.1fixed
Ubuntuunboundpro1.9.0-2ubuntu1vulnerable
Ubuntuunboundpro1.9.0-2ubuntu2vulnerable
Ubuntuunboundpro1.9.4-2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.3vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.4vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.5vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.6vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.8vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.9vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.2vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.4vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.7vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.8vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.10vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.11vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.12vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.13vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.14vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.15vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.16vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.17vulnerable
Ubuntuunbound24.041.17.1-2vulnerable
Ubuntuunbound24.041.18.0-2ubuntu1vulnerable
Ubuntuunbound24.041.18.0-2ubuntu2vulnerable
Ubuntuunbound24.041.19.1-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.2vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.4vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.5vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.6vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.7vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.8vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.9vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.10vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.12vulnerable
Ubuntuunbound26.101.24.2-1ubuntu2vulnerable
Ubuntuunbound26.101.25.1-1ubuntu1vulnerable
Ubuntuunbound26.101.25.1-1ubuntu3vulnerable
Ubuntuunbound26.041.22.0-2ubuntu2vulnerable
Ubuntuunbound26.041.22.0-2ubuntu4vulnerable
Ubuntuunbound26.041.24.2-1ubuntu1vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.1vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.2vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.3vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.4vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianunboundsourcesid1.26.1-1not yet assignedNot reportedNot reported
Debianunboundsourceforky1.26.1-1not yet assignedNot reportedNot reported
Debianunboundsourcetrixie1.26.1-0+deb13u1not yet assignedNot reportedNot reported
Debianunboundsourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpeunboundcpeNot reported1.26.1Not reportedNVD-CVE-2026-78227Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libunbound8]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [libunbound-dev]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [python3-unbound]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound]Affected
    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound-anchor]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound-host]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

[Debian 13 (Trixie)]

  • [libunbound8]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [libunbound-dev]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [python3-unbound]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [unbound]Affected
    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [unbound-anchor]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [unbound-host]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]