Unbound 1.26.2 fixes a DNS-over-QUIC crash and two DNSSEC bypasses

Unbound 1.26.2 fixes a DNS-over-QUIC crash and two DNSSEC bypasses

21 October 2026: NLnet Labs has released Unbound 1.26.2, fixing five vulnerabilities in the open-source recursive DNS resolver. The most serious, CVE-2026-97206, is rated High: a remote DNS-over-QUIC client can crash a multi-threaded Unbound by forcing a QUIC path migration at the wrong moment. Two others let a forged reply weaken DNSSEC validation for a configured trust island, and one turns a non-default setting into a cache-poisoning aid.

Five CVEs, one release

NLnet Labs, the Amsterdam foundation behind Unbound, published all five advisories on 21 October, with severity labels rather than CVSS scores.

CVE	Severity	Effect	Affected
CVE-2026-97206	High	Use-after-free crash over DNS-over-QUIC	1.22.0 to 1.26.1
CVE-2026-50106	Medium	Forged NXDOMAIN treated as insecure inside a trust island	up to 1.26.1
CVE-2026-96405	Medium	CPU exhaustion from chained compression pointers	up to 1.26.1
CVE-2026-109125	Medium	Cache side channel that helps cache poisoning	up to 1.26.1
CVE-2026-35501	Low	Forged NSEC record bypasses a trust island	1.0.1 to 1.26.1

The fix for all five is 1.26.2. For teams that cannot move release, NLnet Labs publishes a patch per CVE for 1.26.1, in most cases both a full patch and a minimal one that touches only the vulnerable code. Debian shipped the update for trixie as 1.26.2-0+deb13u1 in DSA-6581-1 on 23 October.

How the QUIC crash happens

DNS-over-QUIC support arrived in Unbound 1.22.0, which is why the High-rated flaw starts there. NLnet Labs explains that a client-triggered path migration can start cleaning up a stream and its connection while a pending reply still holds a pointer to that stream. Cleanup frees the stream; when the reply completes, Unbound follows the stale pointer and crashes. It needs multi-threaded operation and DoQ enabled, so resolvers that only answer classic DNS over UDP and TCP, or DNS over TLS, are not exposed to this one. The finders were Kunta Chu and Jianjun Chen of Tsinghua University.

Trust islands and the side channel

The two DNSSEC bugs matter only where an operator has added a trust anchor for a zone whose parent is provably insecure, a setup sometimes used for internal signed zones. In that case a forged NXDOMAIN (CVE-2026-50106) or a forged NSEC record with the SOA bit cleared (CVE-2026-35501) could make Unbound treat the island as insecure. NLnet Labs traces the second to an old code path kept for DS and NSEC queries, which 1.26.2 removes.

CVE-2026-109125 depends on unwanted-reply-threshold being set above zero, which is not the default. When the threshold trips, Unbound clears its caches but keeps the pending upstream query open, so an observer can tell whether a guessed source port is the live one and then guess the transaction ID. NLnet Labs calls the attack unreliable at its suggested threshold of 10 million but says it becomes feasible where an attacker can keep a query window open. CVE-2026-96405 is part of what the advisory calls a multi-vendor DNS decompression flaw; 1.26.2 now caps decompression work at 2,048 per upstream reply and 128,000 per zone-transfer packet.

Second release in five weeks

The advisory page lists a separate batch dated 16 September, including one Critical and two High issues fixed in 1.26.1. A resolver patched then is behind again. Earlier this month we also covered the DNS root zone's move to KSK-2024, which changes the root trust anchor resolvers like Unbound validate against.

Company profile on TrustList: NLnet Labs

Sources

• NLnet Labs: Unbound security advisories, 21 October 2026
• NLnet Labs: CVE-2026-97206 advisory text, 21 October 2026
• NLnet Labs: CVE-2026-109125 advisory text, 21 October 2026
• Debian: DSA-6581-1 unbound security update, 23 October 2026