A use‑after‑free bug exists in NLnet Labs Unbound DNS server when DNS‑over‑QUIC (DoQ) path migration occurs during multi‑threaded processing. A remote DoQ client can trigger a path migration that initiates stream and connection cleanup while a pending mesh reply still holds a pointer to the DoQ stream. The cleanup frees the stream and, when the reply later completes, the stale pointer is dereferenced, causing the server to crash. This constitutes a denial of service vulnerability that could be triggered remotely by any DoQ client, classified as CWE-416.

The flaw affects NLnet Labs Unbound versions 1.22.0 through 1.26.1 inclusive. Any deployment of these versions that serves DNS‑over‑QUIC traffic under multi‑threaded operation is vulnerable. The problem is resolved in Unbound 1.26.2 and newer.

The CVSS score is 7.5, indicating high severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation in the short term. The vulnerability is not currently listed in the CISA KEV catalog. Although it only causes a crash, an attacker could potentially use the DoQ protocol to repeatedly trigger the bug and deny service to legitimate clients. The attack requires no privileged access and can be performed by any external DoQ client, making the attack vector remote. No patch is available yet for older versions; updating to 1.26.2 eliminates the issue.