CVE-2026-97206

Name	CVE-2026-97206
Description	NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6581-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
unbound (PTS)	bookworm	1.17.1-2+deb12u4	vulnerable
	bookworm (security)	1.17.1-2+deb12u3	vulnerable
	trixie	1.22.0-2+deb13u3	vulnerable
	trixie (security)	1.26.2-0+deb13u1	fixed
	forky, sid	1.26.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
unbound	source	trixie	1.26.2-0+deb13u1		DSA-6581-1
unbound	source	(unstable)	1.26.2-1

https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495