The CVE number for this vulnerability is CVE-2026-78227.


== Description
Unbound has a use-after-free vulnerability when compiled for DNS-over-QUIC
support with '--with-libngtcp2'.
Each DoQ stream owns an output buffer that holds the DNS response.
ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer
for as long as a STREAM frame may be resent.
On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds
the matching retransmission entries.
The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the
freed buffer.

A malicious actor that can query Unbound over DoQ and that withholds ACKs,
sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no
privilege.
This leads to retransmissions against freed memory and eventually an abnormal
server exit under a 20-query spray.

Unbound 1.26.1 includes a fix to so that on RESET_STREAM it shuts the write
side down so ngtcp2 drops the STREAM frames before the output buffer is freed.


== Affected products
Unbound 1.22.0 up to and including version 1.26.0.


== Mitigation

=== Downloading patched version
Unbound 1.26.1 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz

=== Applying the patch manually
For Unbound 1.26.0 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-78227.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-78227.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.26.0.


== Acknowledgments
We would like to thank Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab
for discovering and responsibly disclosing the vulnerability.