{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "NLnet Labs unbound: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/nlnet-labs--unbound/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/nlnet-labs--unbound/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-97206/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-97206/",
   "title": "CVE-2026-97206 · NLnet Labs unbound · disclosed",
   "content_text": "NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.",
   "date_published": "2026-10-21T08:57:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-97206/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-97206/",
   "title": "CVE-2026-97206 · NLnet Labs unbound · fixed in Debian 13 (unbound 1.26.2-0+deb13u1)",
   "content_text": "Fixed versions: unbound 1.26.2-0+deb13u1.",
   "date_published": "2026-10-21T08:57:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-97206/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-97206/",
   "title": "CVE-2026-97206 · NLnet Labs unbound · fixed in Debian 14 (unbound 1.26.2-1)",
   "content_text": "Fixed versions: unbound 1.26.2-1.",
   "date_published": "2026-10-21T08:57:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-97206/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-97206/",
   "title": "CVE-2026-97206 · NLnet Labs unbound · fixed in openSUSE Tumbleweed (unbound 1.26.2-1.1)",
   "content_text": "Fixed versions: unbound 1.26.2-1.1.",
   "date_published": "2026-10-21T08:57:41Z"
  }
 ]
}