CVE-2026-78227: NLnet Labs Unbound Use-After-Free Vulnerability

CVE-2026-78227 is a use-after-free vulnerability in NLnet Labs Unbound affecting DNS-over-QUIC implementations. Attackers can exploit this flaw to cause server crashes through malicious queries. This article covers technical details, affected versions, impact analysis, and recommended mitigation strategies.

CVE-2026-78227 Overview

CVE-2026-78227 is a use-after-free vulnerability in NLnet Labs Unbound, a widely deployed validating, recursive, caching DNS resolver. The flaw affects versions 1.22.0 through 1.26.1 when compiled with DNS-over-QUIC (DoQ) support using --with-libngtcp2. An unauthenticated remote attacker who can query Unbound over DoQ can trigger retransmissions against freed memory by withholding ACKs, sending RESET_STREAM, and waiting for a probe timeout (PTO). A short 20-query spray is sufficient to cause abnormal server termination, disrupting DNS resolution for all downstream clients.

Critical Impact
Unauthenticated remote attackers can crash Unbound resolvers configured for DoQ, producing a denial-of-service condition against DNS infrastructure.

Affected Products

NLnet Labs Unbound 1.22.0 through 1.26.1 compiled with --with-libngtcp2
Deployments exposing DNS-over-QUIC listeners to untrusted networks
Downstream resolver clients dependent on affected Unbound instances

Discovery Timeline

2026-09-16 - CVE-2026-78227 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-78227

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Unbound's DNS-over-QUIC handling path. Each DoQ stream owns an output buffer that holds the DNS response returned to the client. The underlying ngtcp2 library retains a shallow pointer into that output buffer inside its retransmission queue for as long as the corresponding STREAM frame may need to be resent.

When a client sends RESET_STREAM, Unbound frees the per-stream output buffer. However, ngtcp2 does not discard the retransmission entries that still reference the freed memory. On the next PTO expiration, ngtcp2 re-encodes the STREAM frame and copies bytes from the already freed buffer, producing undefined behavior and eventually an abnormal process exit.

Root Cause

The root cause is a lifetime mismatch between Unbound's DoQ output buffer and ngtcp2's retransmission bookkeeping. Unbound treats RESET_STREAM as a signal to release stream-owned resources without informing ngtcp2 to drop matching retransmission pointers. The transport layer therefore continues to reference freed heap memory.

Attack Vector

The attack requires only network reachability to Unbound's DoQ endpoint and no authentication. An attacker opens DoQ streams, issues DNS queries, withholds QUIC ACK frames, sends RESET_STREAM for the outstanding streams, and waits for the PTO to fire. Repeating this pattern across roughly 20 concurrent queries reliably reaches the use-after-free and terminates the resolver. The high attack complexity reflects the need to precisely orchestrate QUIC transport state rather than any protective control on the server.

No verified proof-of-concept code has been published. Refer to the NLnet Labs CVE-2026-78227 Notice for authoritative technical details.

Detection Methods for CVE-2026-78227

Indicators of Compromise

Unexpected unbound process crashes or restarts on hosts with DoQ enabled
Core dumps or SIGSEGV/SIGABRT signals originating in ngtcp2 retransmission code paths
Bursts of QUIC RESET_STREAM frames from a small set of source addresses shortly before a crash
Elevated PTO-driven retransmissions in QUIC transport telemetry preceding service failure

Detection Strategies

Monitor Unbound systemd unit state and restart counters for abnormal exits correlated with DoQ traffic
Inspect QUIC flow telemetry for clients that open streams, suppress ACKs, and then issue RESET_STREAM
Enable verbose logging on the DoQ listener and alert on repeated stream resets from the same peer

Monitoring Recommendations

Collect resolver process crash telemetry into a centralized logging or SIEM pipeline for correlation
Baseline normal DoQ query volume and alert on sudden 20+ query bursts followed by resets
Track upstream DNS availability metrics so cascading resolution failures are surfaced quickly

How to Mitigate CVE-2026-78227

Immediate Actions Required

Inventory all Unbound instances and identify builds compiled with --with-libngtcp2 and DoQ enabled
Disable the DoQ listener on affected resolvers until a patched build is deployed
Restrict DoQ access at the network edge to trusted clients using firewall or ACL controls
Ensure resolver auto-restart is configured so a crash does not create a prolonged outage

Patch Information

Consult the NLnet Labs CVE-2026-78227 Notice for the vendor's fixed version guidance and upgrade path. Upgrade Unbound to the vendor-designated fixed release, or rebuild without --with-libngtcp2 if DoQ is not required in your environment.

Workarounds

Rebuild Unbound without --with-libngtcp2 to remove the vulnerable DoQ code path entirely
Terminate DoQ at an upstream proxy or load balancer that is not affected by this issue
Rate-limit or block source addresses that generate anomalous RESET_STREAM patterns

bash

# Configuration example: disable DoQ in unbound.conf until patched
server:
    # Comment out or remove any DoQ interface bindings
    # interface: 0.0.0.0@853
    # Ensure the QUIC listener is not enabled
    # https-port: 443
    # quic-port: 853
    do-tcp: yes
    do-udp: yes