Description
In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path.
Published: 2026-07-22
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A heap use‑after‑free occurs when a DoT forwarded query is jostled out of the server while the TLS handshake is still in progress. The affected string is freed in one structure but still referenced in another, and a subsequent error causes the TLS stream to dereference the freed pointer. Because the dereference is read‑only, the immediate consequence is a daemon crash rather than arbitrary code execution. The crash leads to a denial‑of‑service for the affected Unbound instance. This is a classic case of CWE‑416.

Affected Systems

The vulnerability affects NLnet Labs Unbound versions 1.15.0 through 1.25.1. A configuration that includes a stub or forward zone directed to a DoT server, together with a #authname suffix on the server identifier, is required to expose the flaw.

Risk and Exploitability

The CVSS score of 5.9 places the flaw in the medium severity range. The EPSS score of < 1% reflects a very low probability of exploitation, and the issue is not listed in CISA KEV, indicating no widespread exploitation is currently documented. Exploitation would require a malicious actor to send queries to an appropriate zone while the Unbound process is under load and a transient TLS failure occurs at just the right moment, making successful attacks difficult but still theoretically possible. These constraints suggest the risk is low to moderate, but patching removes the vulnerability entirely.

Generated by OpenCVE AI on August 3, 2026 at 23:47 UTC.

Remediation

Vendor Solution

This issue is fixed starting with version 1.25.2

OpenCVE Recommended Actions

  • Upgrade Unbound to version 1.25.2 or later, which contains the fix for the use‑after‑free.
  • If DoT forwarding is not required, disable the stub/forward zone or remove the #authname suffix to eliminate the attack surface.
  • Apply rate limiting or connection throttling to reduce the likelihood of jostle conditions during high‑traffic periods.

Generated by OpenCVE AI on August 3, 2026 at 23:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 31 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Nlnetlabs
Nlnetlabs unbound
Vendors & Products Nlnetlabs
Nlnetlabs unbound

Wed, 22 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Description In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path.
Title Possible heap use-after-free in an error path when a DoT forwarded query is jostled out
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nlnetlabs Unbound
cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-07-22T18:57:33.147Z

Reserved: 2026-06-22T12:27:22.824Z

Link: CVE-2026-50046

cve-icon Vulnrichment

Updated: 2026-07-22T18:57:28.535Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T14:17:20.117

Modified: 2026-07-24T13:55:29.627

Link: CVE-2026-50046

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-22T13:08:08Z

Links: CVE-2026-50046 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:00:09Z

Weaknesses