The CVE number for this vulnerability is CVE-2026-50046.


== Summary
The TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to
a struct's ('serviced_query') lifetime but also referenced by another struct
('waiting_tcp').
When the owning struct is jostled out of the mesh while the DoT TCP stream is
still handshaking it frees the storage behind the referenced string and if the
TLS stream then errors out, it dereferences the freed pointer.
The dereference is read-only and the practical impact is a daemon crash
resulting in denial of service.


Unbound 1.25.2 includes a fix to own (copy) the TLS server name solving the
lifetime issue on error paths.


== Affected products
Unbound 1.15.0 up to and including version 1.25.1.


== Description
A malicious actor that knows a DoT forwarding/stub Unbound's configuration
could exploit the vulnerability by quering records in the appropriate zone
while keeping Unbound uder pressure so that the jostle logic kicks in.
If answers for the vulnerable zone are slow, the likelihood of jostling such
queries is higher, although the timing of the jostle needs to be precise.

Requirements for a vulnerable Unbound is the existence of a stub/forward zone
configured for DoT together with a configured '#authname' suffix on the server
identification.
The connectivity to the server needs to exhibit a transient failure at the
correct time in order to kick off the vulnerable error path.

Unbound 1.25.2 includes a fix to own (copy) the TLS server name solving the
lifetime issue on error paths.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-50046.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-50046.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.