Key points
- Unbound 1.26.2 was released on October 21 to address multiple security vulnerabilities.
- The update fixes CVE-2026-97206, a high-severity flaw in DoQ path migration.
- The vulnerability can lead to a use-after-free error in multi-threaded deployments.
Unbound version 1.26.2 is now available as a security release. This update addresses several vulnerabilities, including a high-severity issue affecting DNS over QUIC path migration. The release was announced on October 21 by Yorgos Thessalonikefs via the oss-security mailing list. An official announcement is also available on the NLNet Labs community forum.
In plain English
The primary issue fixed in this release is CVE-2026-97206. This vulnerability involves a use-after-free error that occurs during DoQ path migration. It specifically affects deployments that use multiple threads. A use-after-free error happens when a program tries to access memory that has already been freed, which can lead to crashes or other unexpected behavior.
The background
The oss-security mailing list advisory details the release of Unbound 1.26.2. The advisory states that several vulnerabilities were found in the software. The release includes fixes for these issues. The advisory specifically highlights CVE-2026-97206 as a high-severity item. The description notes that the flaw allows DoQ path migration to lead to a use-after-free condition.
What changes now
Administrators using Unbound can now apply the 1.26.2 update. This version contains the necessary code changes to resolve the identified vulnerabilities. The release is designated as a security release. Users should verify that their current version is susceptible and apply the patch. The advisory confirms that the fixes are included in this specific version number.
Who needs to act first
Teams usually prioritize updating systems that are exposed to the internet first. Check whether your Unbound instances handle DNS over QUIC traffic from external sources. Before rolling out the update to all servers, test the new version in a staging environment to ensure compatibility with your configuration. Back up your current configuration files and data before making changes. Monitor system logs closely after the update to detect any anomalies. If you cannot update immediately, consider restricting access to the service from untrusted networks.
What to do and how to stay safe: Unbound
- Identify all systems running Unbound versions prior to 1.26.2.
- Verify if your deployment uses multi-threaded configurations for DNS over QUIC.
- Apply the 1.26.2 update to affected systems after testing in a non-production environment.
- Monitor system logs for signs of memory errors or unexpected crashes after the update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-97206?
It is a high-severity vulnerability in Unbound where DoQ path migration can lead to a use-after-free error.
Which version of Unbound fixes this issue?
Unbound 1.26.2 includes the relevant fixes for this and other vulnerabilities.
When was this security release announced?
The release was announced on October 21 via the oss-security mailing list.
