CVE-2026-78227

A flaw was found in Unbound. This vulnerability occurs in the DNS-over-QUIC (DoQ) stream output buffer when a client sends a RESET_STREAM, causing the output buffer to be freed while retransmission entries still point to it. A remote attacker, by querying Unbound over DoQ, withholding acknowledgments, and sending a RESET_STREAM, can trigger this flaw. This leads to retransmissions against freed memory, ultimately resulting in a denial of service due to an abnormal server exit.

This Moderate impact use-after-free vulnerability in Unbound affects configurations compiled with DNS-over-QUIC (DoQ) support. Most Red Hat Enterprise Linux products are not impacted as their Unbound packages do not include the vulnerable DoQ functionality. This only affects Red Hat hardened images.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this do not set quic-port unless DNS-over-QUIC is required. If it is enabled, allow it only from trusted clients.