CVE-2026-97206

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 0.33%
EPSS Percentile: 26.68%
CISA KEV: Not listed

Description

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 21-Oct-2026 16:17
Last Modified: 22-Oct-2026 22:22
EPSS Date: 2026-10-29
CWE: CWE-416

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:N /
                            I:N /
                            A:H

References

[email protected]

Last enrichment sync: 30-Oct-2026 00:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2026-110264 CVE-2026-111497 CVE-2026-115560 CVE-2026-19630 CVE-2026-91403 CVE-2026-96325 CVE-2026-97206 DarkWeb data-breach DeepSeek DoS e-commerce Education 미국 Finance France generative-AI GitLab GLM AhnLab Reviews October Breaches and AI-Agent Attacks on Peripheral Systems

CVE (12)

Threat Actors (1)

MITRE ATT&CK (6)

Vendors (2)

Products (11)

Tools (3)

Industries (7)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.