CVE-2026-82720: Unbound DNS Use-After-Free Vulnerability

CVE-2026-82720 Overview

CVE-2026-82720 is a use-after-free vulnerability [CWE-416] in NLnet Labs Unbound, an open-source recursive DNS resolver. The flaw affects Unbound versions 1.12.0 through 1.26.0 when compiled with DNS-over-HTTPS (DoH) support via the --with-libnghttp2 build option. During failure code paths such as Response Policy Zone (RPZ) drop queries or stream jostling under heavy traffic, a dropped DoH stream terminates the entire DoH session without properly accounting for other streams in the same session. A remote attacker with a single DoH connection can trigger the condition and cause denial of service on affected resolvers.

Critical Impact
A hardened memory allocator can catch the use-after-free and controllably terminate the Unbound process, resulting in denial of service for DNS resolution.

Affected Products

NLnet Labs Unbound 1.12.0 through 1.26.0 (inclusive)
Unbound builds compiled with --with-libnghttp2 for DoH support
Deployments serving DoH clients or exposed to DoH traffic

Discovery Timeline

2026-09-16 - CVE-2026-82720 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82720

Vulnerability Analysis

Unbound implements DoH transport using the libnghttp2 library, which multiplexes multiple HTTP/2 streams over a single TLS connection. Each DoH session may carry several concurrent DNS query streams. When a single stream is dropped through a failure path, the current code tears down state associated with the entire session rather than only the affected stream.

The two documented failure paths are RPZ drop actions, where the resolver policy discards a matching query, and stream jostling, where the resolver evicts streams under heavy client traffic. In both paths, sibling streams within the same session continue to reference freed session state, producing a use-after-free condition described in [CWE-416].

The reads that follow the free are not attacker controlled, and the affected code paths return early. The primary risk is process termination when Unbound runs under a hardening allocator that detects invalid access. Detailed technical analysis is available in the NLnet Labs advisory for CVE-2026-82720.

Root Cause

The root cause is incorrect lifetime management of DoH session objects. The DoH cleanup routine treats a single dropped stream as a signal to release the whole session context. Other streams still bound to that session retain dangling references and access memory after it has been freed.

Attack Vector

An attacker establishes one DoH connection to a vulnerable Unbound resolver and issues traffic that triggers a stream drop. This requires either a query matched by an RPZ drop rule or sufficient concurrent load to cause jostling. No authentication or user interaction is required, but attack complexity is high because the attacker must satisfy these preconditions on the target resolver.

No verified public exploit code is available. Refer to the vendor advisory for the technical description of the affected code paths.

Detection Methods for CVE-2026-82720

Indicators of Compromise

Unexpected termination of the unbound process, particularly with abort signals from hardened allocators such as MALLOC_CHECK_ or scudo
Crash reports or core dumps referencing DoH handler functions or libnghttp2 stream callbacks
Repeated DoH session resets from a single client source address correlated with resolver restarts

Detection Strategies

Monitor Unbound service supervisor logs (systemd, runit) for repeated restarts of the resolver process
Alert on segmentation faults or SIGABRT events attributed to the unbound binary in kernel or audit logs
Correlate DoH connection anomalies with DNS resolution outages across the environment

Monitoring Recommendations

Enable Unbound verbosity logging to capture DoH stream lifecycle events and RPZ hits
Track DoH query rates and unique source addresses to identify abnormal traffic bursts consistent with jostling triggers
Forward resolver telemetry and host process events to a centralized analytics platform for cross-source correlation

How to Mitigate CVE-2026-82720

Immediate Actions Required

Inventory all Unbound deployments and identify builds compiled with --with-libnghttp2 DoH support
Upgrade affected instances to a fixed Unbound release published by NLnet Labs beyond version 1.26.0
Restrict DoH endpoints to trusted client networks where operationally feasible
Review RPZ configurations to understand which queries can trigger drop actions on public-facing resolvers

Patch Information

NLnet Labs has published details in the CVE-2026-82720 advisory. Apply the fixed Unbound release referenced in that document. Rebuild from source or install vendor packages that include the corrected DoH stream cleanup logic.

Workarounds

Disable DoH by rebuilding Unbound without --with-libnghttp2 if the feature is not required
Remove RPZ drop actions from configuration on internet-exposed resolvers until patched
Place a rate-limiting reverse proxy in front of the DoH listener to reduce the likelihood of stream jostling

bash

# Disable DoH listener in unbound.conf until patched
server:
    # Comment out or remove DoH-related directives
    # https-port: 443
    # tls-service-key: "/etc/unbound/tls.key"
    # tls-service-pem: "/etc/unbound/tls.pem"

# Verify configuration and restart
# unbound-checkconf /etc/unbound/unbound.conf
# systemctl restart unbound