NLnet Labs Unbound EUVD-2026-107154

Exploitation requires that the target Unbound resolver (1.22.0-1.26.1) has DNS-over-QUIC (DoQ) enabled AND is running in multi-threaded mode - both are the specific preconditions named in the description; neither is the universal default for Unbound deployments. The attacker must be a remote DoQ client able to initiate a QUIC connection and trigger a path migration (PR:N, no authentication) while a mesh reply for that stream is still pending, i.e. the attacker must hit the timing window in which cleanup and the outstanding reply overlap. Limiting factors: resolvers that do not expose DoQ, or run single-threaded, are not affected; success is race-dependent, so a single attempt may not reliably crash the service; impact is confined to availability (service crash) with no data exposure or code execution indicated.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remote, unauthenticated, availability-only impact with no confidentiality or integrity loss - consistent with the description, which explicitly ends in a crash (denial of service), not code execution, despite the CWE-416 use-after-free classification. One caveat: the vendor rated attack complexity as AC:L, but the described mechanism is a race between QUIC path-migration-triggered stream/connection cleanup and a still-pending mesh reply holding a stale pointer under multi-threaded operation; a timing-window race of this kind more honestly warrants AC:H, which would lower the real-world score. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced - only a vendor advisory from NLnet Labs. Net assessment: a real, patch-worthy DoS affecting resolvers that have specifically enabled DNS-over-QUIC with multiple threads, but NOT a drop-everything widespread-exploitation emergency - exploitation is gated by a non-default protocol feature and a timing-dependent race, and there is no evidence of exploitation in the wild.

A remote attacker connects to an Unbound resolver that has DNS-over-QUIC enabled and runs with multiple threads, then issues queries and triggers a QUIC connection path migration at a moment when a mesh reply is still pending for that stream. The cleanup frees the DoQ stream while the pending reply retains a pointer to it, and when the reply later completes it dereferences the freed memory, crashing the resolver and denying DNS service to downstream clients. No public exploit code is identified at time of analysis, and exploitation depends on winning a timing race.