CVE-2026-97206

What it actually does

Use-after-free vulnerability in DNS-over-QUIC stream handling where a client-triggered QUIC path migration causes stream/connection cleanup to free a DoQ stream while a pending mesh reply still holds a pointer to it, resulting in a stale pointer dereference and crash under multi-threaded operation.

Why it matters to the business

Remote attackers can trigger denial-of-service crashes against Unbound resolvers supporting DoQ, causing temporary loss of DNS resolution availability for dependent services and clients; low exploitation probability but high operational impact in environments relying on high-availability DNS.

How an attack unfolds

An attacker establishes a DoQ connection to a multi-threaded Unbound instance, initiates a QUIC path migration to force stream cleanup while a mesh reply is pending, and triggers the use-after-free when the reply later dereferences the freed stream pointer, crashing the resolver.

How to fix it

Upgrade Unbound from versions 1.22.0 through 1.26.1 to the latest patched release that resolves the DoQ lifetime handling issue; disable DoQ support if immediate upgrade is not feasible until a fix is applied.

How to confirm the fix worked

Confirm Unbound version is newer than 1.26.1, enable DoQ in test environments and attempt QUIC path migration scenarios while monitoring for crashes or pointer errors in logs and process stability.

Typical attack path

1. Establish remote DoQ connection to target Unbound instance
2. Trigger QUIC path migration from the client side
3. Force concurrent stream/connection cleanup during active mesh reply processing
4. Cause crash via stale pointer dereference in pending reply completion

How to detect it

Review Unbound process and system logs for segmentation faults or crashes correlated with active DoQ connections; inspect for repeated DoQ stream handling errors or mesh reply failures under multi-threaded load.

What your security team should do

• Prioritize upgrade of all Unbound instances supporting DoQ within maintenance windows given the remote unauthenticated attack vector
• Review and apply vendor patch notes for DoQ stream lifetime fixes
• Monitor EPSS and KEV status for any future increase in exploitation activity
• Consider temporary DoQ disablement in high-risk or internet-facing deployments until patched