CVE-2026-78227

A flaw was found in Unbound. This vulnerability occurs in the DNS-over-QUIC DoQ stream output buffer when a client sends a RESETSTREAM, causing the output buffer to be freed while retransmission entries still point to it. A remote attacker, by querying Unbound over DoQ, withholding acknowledgment...

CVE-2026-78227

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffe...

CVE-2026-78227

NLnet Labs Unbound versions 1.22.0 through 1.26.1 contain a use-after-free vulnerability in the DNS-over-QUIC (DoQ) implementation, triggered only when compiled with '--with-libngtcp2'. The root cause is that ngtcp2's retransmission buffer retains a shallow pointer into a per-stream output buffer...

Use After Free

Envoy is vulnerable to a Use-After-Free vulnerability. The vulnerability is due to improper handling in HttpConnectionManager HCM with EnvoyQuicServerStream, where an attacker can crash Envoy by sending a request without FIN, followed by a RESETSTREAM frame, and then closing the connection after...

BIT-ENVOY-2024-34362 Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream

Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in HttpConnectionManager HCM with EnvoyQuicServerStream that can crash Envoy. An attacker can exploit this vulnerability by sending a request without FIN, then a RESETSTREAM frame, and then after receiving the...

CVE-2024-34362

Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in HttpConnectionManager HCM with EnvoyQuicServerStream that can crash Envoy. An attacker can exploit this vulnerability by sending a request without FIN, then a RESETSTREAM frame, and then after receiving the...

CVE-2024-34362 Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream

Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in HttpConnectionManager HCM with EnvoyQuicServerStream that can crash Envoy. An attacker can exploit this vulnerability by sending a request without FIN, then a RESETSTREAM frame, and then after receiving the...