NLnet Labs Unbound EUVD-2026-80293

Two prerequisites must both hold. (1) Build/deployment gate: Unbound must be compiled with '--with-libnghttp2' so DNS-over-HTTPS is enabled - non-DoH builds are unaffected. (2) A failure code path must be reachable, meaning the resolver either has an RPZ policy that can produce a drop-query action, or is under client traffic heavy enough to make Unbound jostle (drop) DoH streams. Given those, a single malicious DoH connection with the appropriate traffic triggers it - no authentication (PR:N) and no user interaction (UI:N) are required. Limiting factors: the non-default DoH compile option, the need for an RPZ drop condition or sustained heavy traffic (reflected as AC:H), and the fact that impact is confined to availability (a controlled process termination under a hardening allocator) with no confidentiality or integrity effect.

This is a genuine but low-priority denial-of-service issue whose real-world risk is well below its 5.9 CVSS medium score would casually suggest for a memory-corruption class (CWE-416). Every impact signal points to availability only: the vendor CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) sets C:N and I:N, and the description explicitly caps impact - the freed-object reads are NOT attacker-controlled and the use-after-free merely causes early returns; corruption becomes a hard crash only when a hardening allocator deliberately aborts the process. So despite the 'Memory Corruption' tag, this is not a code-execution path. AC:H is correctly chosen because exploitation is gated on preconditions outside the attacker's direct control: the resolver must be built with '--with-libnghttp2' (DoH), and the vulnerable failure path only fires on an RPZ drop-query decision or jostle under heavy traffic. No exploitation-probability corroboration is available - no EPSS score, no CISA KEV listing, and no public exploit code (single vendor advisory only) - so exploitation status is 'no public exploit identified at time of analysis'. There is no SSVC decision data supplied. Net: the CVSS vector, CWE, and description are internally consistent and the metric is well-calibrated; this is a legitimate reliability bug for DoH-enabled Unbound operators to patch on a normal cycle, not an emergency.

An attacker opens a single DNS-over-HTTPS connection to an Unbound resolver built with libnghttp2 and sends traffic that triggers a stream drop - either names matching an RPZ policy that drops the query, or a flood heavy enough to make Unbound jostle (drop) streams. The dropped stream tears down the whole DoH session without accounting for the session's other live streams, dereferencing freed memory; with a hardening allocator this deterministically aborts the worker process, denying service. No public exploit code is known and there is no confidentiality or code-execution outcome.