NLnet Labs Unbound EUVD-2026-80288

Unbound must be compiled with '--with-libngtcp2' and actively serving DNS-over-QUIC (DoQ); default builds without QUIC support are not affected. The attacker needs network reachability to the DoQ listener but no authentication or privilege (PR:N) and no user interaction. Exploitation requires a specific QUIC protocol sequence - issue a query, withhold ACKs, send RESET_STREAM to free the stream output buffer, then wait for the PTO timeout to trigger retransmission from freed memory - repeated across roughly 20 queries to force an abnormal server exit. The AC:H rating reflects both the timing-dependent QUIC state manipulation and the non-default compile-time configuration that gate exploitation.

This is a moderate, config-gated availability threat rather than a top-tier priority. The vendor CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L) correctly captures network reach with no privilege (PR:N) and high complexity (AC:H) reflecting the QUIC/PTO timing sequence and the non-default build requirement. However the impact weighting is questionable: the description demonstrates only 'retransmissions against freed memory and eventually an abnormal server exit' - a crash - which argues for A:H, not A:L, for a recursive resolver whose crash denies name resolution to all downstream clients; conversely C:H appears overstated because no data disclosure is demonstrated (the use-after-free could re-transmit reused freed memory back to the attacker's own connection, giving at most a low, unproven confidentiality vector). No EPSS score, KEV entry, POC, or SSVC decision data is provided in the input. Exploitation status: no public exploit identified at time of analysis. The dominant limiting factor is that Unbound must be compiled with '--with-libngtcp2' and have DNS-over-QUIC enabled - a niche, non-default deployment - which sharply reduces the real-world attack surface despite the network-facing, unauthenticated vector. Net: prioritize patching only for the subset of Unbound instances actually serving DoQ; general Unbound deployments are unaffected.

An unauthenticated attacker who can reach an Unbound resolver over DNS-over-QUIC opens a stream, issues a query, deliberately withholds ACKs, then sends a RESET_STREAM to free the stream's output buffer while ngtcp2 still holds retransmission pointers into it. On the subsequent PTO timeout, ngtcp2 re-encodes the STREAM frame from the freed buffer; repeating this roughly 20 times crashes the resolver. No public exploit code is identified at time of analysis.