# CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

> A remote attacker can crash the Unbound DNS resolver by triggering a use-after-free in DoT error handling, requiring specific DoT forwarding configurations.

- **Severity:** Medium 5.9 (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 22 Jul 2026
- **Updated:** 22 Jul 2026
- **Also known as:** ALPINE-CVE-2026-50046, AZL-92970, DEBIAN-CVE-2026-50046, ECHO-c79d-4d79-8029, GHSA-fg9v-m7xf-p865, UBUNTU-CVE-2026-50046

## What is CVE-2026-50046?

CVE-2026-50046 is a medium-severity use after free vulnerability in Nlnetlabs Unbound, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path.

Weakness: CWE-416 (Use After Free)

## Which versions are affected by CVE-2026-50046?

It affects 1 product.


Products: Nlnetlabs Unbound.

## How do I fix CVE-2026-50046?

Upgrade to a fixed version.

## Is CVE-2026-50046 being exploited?

There is no known exploitation of CVE-2026-50046 in the wild and no public exploit code.

## Other vulnerabilities in Nlnetlabs Unbound

- [CVE-2026-81642](https://insights.sbomify.com/CVE-2026-81642/): Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (critical 9.1)
- [CVE-2026-33278](https://insights.sbomify.com/CVE-2026-33278/): Possible arbitrary code execution during DNSSEC validation (critical 9.1)
- [CVE-2026-42944](https://insights.sbomify.com/CVE-2026-42944/): Heap overflow with multiple NSID, COOKIE, PADDING EDNS options (high 8.7)
- [CVE-2026-42959](https://insights.sbomify.com/CVE-2026-42959/): Crash during DNSSEC validation of malicious content (high 8.7)
- [CVE-2026-82717](https://insights.sbomify.com/CVE-2026-82717/): CNAME synthesis could lead to heap corruption (high 8.4)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-50046 and fix it if it is affected.

What it is: CVE-2026-50046 is a medium-severity use after free vulnerability in Nlnetlabs Unbound, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-50046 in the wild and no public exploit code.

Affected product: Nlnetlabs Unbound. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-50046/ (Markdown: https://insights.sbomify.com/CVE-2026-50046/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-50046
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50046
- OSV: https://osv.dev/vulnerability/CVE-2026-50046

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-50046/
Summaries are generated and may contain mistakes; the official description above is the record.