Unbound 1.12.0 through 1.26.0, when compiled with the DNS-over-HTTPS flag, contains a use‑after‑free in the DoH stream cleanup. The flaw is triggered during failure paths such as RPZ drops or high traffic churn, causing a dropped stream to corrupt the session and free memory that may still be referenced. The read access is not user‑controllable and the immediate effect is an early return, but with a hardened allocator the use‑after‑free can be caught and the process can terminate. Thus the primary impact is a denial of service to the DNS service rather than confidentiality or integrity leakage.

NLnet Labs Unbound v1.12.0 up to v1.26.0 compiled with '--with-libnghttp2' for DNS-over-HTTPS support are affected. Versions newer than 1.26.0, including 1.26.1, contain the fix.

The CVSS score is 5.9, indicating moderate severity, and the EPSS score is not available, so the precise likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog. The attack would require malicious DoH traffic that triggers a failure condition such as an RPZ drop or traffic overload. Exploitation would result in the unbound process terminating, causing a denial of service to all clients using that resolver. More advanced configurations using hardened allocators may detect the memory error and abort the process, amplifying the impact. No public exploit has been reported, but the conditions for triggering the flaw are realistic in high‑traffic or misconfigured environments.