{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82720", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "state": "PUBLISHED", "assignerShortName": "NLnet Labs", "dateReserved": "2026-09-07T14:06:21.960Z", "datePublished": "2026-09-16T08:32:10.359Z", "dateUpdated": "2026-09-16T08:32:10.359Z"}, "containers": {"cna": {"title": "Use-after-free in DoH stream cleanup code path", "datePublic": "2026-09-16T00:00:00.000Z", "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"version": "1.12.0", "status": "affected", "lessThan": "1.26.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "Compiled with DNS-over-HTTPs support"}], "cvssV3_1": {"version": "3.1", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-416", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.26.1"}], "timeline": [{"time": "2026-08-11T00:00:00.000Z", "lang": "en", "value": "Issue reported by Yuqi Qiu"}, {"time": "2026-08-13T00:00:00.000Z", "lang": "en", "value": "NLnet Labs shares patch"}, {"time": "2026-08-14T00:00:00.000Z", "lang": "en", "value": "Yuqi Qiu verifies patch"}, {"time": "2026-09-16T00:00:00.000Z", "lang": "en", "value": "Fixes released with version 1.26.1"}], "credits": [{"lang": "en", "value": "Yuqi Qiu (Nankai University, AOSP Lab)", "type": "finder"}, {"lang": "en", "value": "Xiang Li (Nankai University, AOSP Lab)", "type": "finder"}], "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82720.txt", "tags": ["vendor-advisory"]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-09-16T08:32:10.359Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Unbound", "vendor": "NLnet Labs", "versions": [{"lessThan": "1.26.1", "status": "affected", "version": "1.12.0", "versionType": "semver"}]}], "source": "sep@nlnetlabs.nl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service."}], "id": "CVE-2026-82720", "lastModified": "2026-09-16T09:17:06.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "sep@nlnetlabs.nl", "type": "Secondary"}]}, "published": "2026-09-16T09:17:06.677", "references": [{"source": "sep@nlnetlabs.nl", "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82720.txt"}], "sourceIdentifier": "sep@nlnetlabs.nl", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "sep@nlnetlabs.nl", "type": "Secondary"}]}

{"bugzilla": {"description": "unbound: Unbound: Denial of Service via use-after-free in DoH stream cleanup", "id": "2535060", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535060"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in Unbound. When compiled with DNS-over-HTTPs (DoH) support, a use-after-free vulnerability exists in the DoH stream cleanup code. A remote malicious actor can exploit this by sending a specially crafted DoH connection under specific failure conditions, such as an RPZ drop query or heavy traffic. This can lead to a denial of service (DoS) by causing the Unbound process to terminate."], "name": "CVE-2026-82720", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-16T08:32:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-82720\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-82720\nhttps://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82720.txt"], "threat_severity": "Moderate"}

{}