CVE-2026-82720 in Unbound
Summary
by MITRE • 09/16/2026
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in NLnet Labs Unbound versions 1.12.0 through 1.26.0 represents a critical memory management flaw within the DNS-over-HTTPS implementation, specifically when the software is compiled with support for libnghttp2. This use-after-free condition arises from improper resource lifecycle management during specific failure code paths. The core technical issue lies in how the application handles the termination of individual HTTP/2 streams that are part of a larger DoH session. When an event such as Response Policy Zone (RPZ) dropping a query or traffic jostling due to heavy load occurs, the system incorrectly terminates the entire DoH session rather than isolating the failure to the specific stream involved. This aggressive teardown mechanism fails to account for other active streams within that same session, leading to premature deallocation of memory structures associated with those remaining streams while they are still in use by the application logic.
From a technical perspective, this flaw is classified under CWE-416, Use After Free, which describes situations where software continues to use memory after it has been freed for reuse. In this specific context, the vulnerability is triggered when a malicious actor or high-volume traffic patterns cause an RPZ drop or significant jostling. The attacker can exploit this by establishing a single DoH connection and manipulating traffic conditions to induce the faulty code path. Because the application attempts to free resources associated with streams that are still being processed or referenced, it results in accessing invalid memory addresses. While the immediate impact is somewhat constrained because the reads involved are not directly user-controlled for arbitrary data execution, the consequence of this memory corruption is a crash or early return from critical functions. This behavior effectively destabilizes the resolver service, leading to a denial of service condition where legitimate DNS queries cannot be processed correctly.
The operational impact of this vulnerability extends beyond simple application instability. By leveraging hardened allocators such as those found in modern operating systems like Windows with Guard Malloc or Linux with AddressSanitizer, an attacker can force the process into a controlled termination state. This means that even if arbitrary code execution is not feasible due to the nature of the memory access, the reliability and availability of the DNS resolution service are severely compromised. For organizations relying on Unbound for secure recursive resolution over HTTPS, this vulnerability presents a significant risk to service continuity. An attacker does not need complex multi-stage exploits; rather, they can trigger the condition with minimal interaction by inducing specific traffic patterns or RPZ events that expose the race condition in session teardown logic.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is upgrading to a patched version of Unbound released after this vulnerability was disclosed, as NLnet Labs has addressed the improper handling of stream termination within sessions. In environments where patching cannot be applied immediately, network-level controls can help mitigate risk by limiting the rate of incoming DoH connections and implementing strict RPZ policies that minimize unexpected drops during peak traffic periods. Additionally, deploying intrusion detection systems capable of identifying anomalous DNS-over-HTTPS traffic patterns may provide early warning indicators of exploitation attempts. From a broader security posture perspective, this incident highlights the importance of rigorous code review for HTTP/2 stream management in network services and adherence to secure coding standards that prevent use-after-free conditions through proper reference counting or smart pointer usage.
This vulnerability aligns with ATT&CK techniques related to resource hijacking and denial of service via application layer attacks. Specifically, it reflects weaknesses in how applications manage shared resources during error handling scenarios. Security teams should prioritize verifying the compilation flags used for their Unbound instances to ensure libnghttp2 support is present but also that the software version is current. Regular auditing of DNS resolver logs for unusual termination events or increased latency can serve as a secondary detection mechanism. Ultimately, resolving this issue requires not only updating the software binary but also reinforcing the resilience of the underlying HTTP/2 session management logic to ensure that individual stream failures do cascade into broader service disruptions.