Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
NLnet Labs patched a critical heap overflow (CVE-2026-81642) in Unbound's DNSSEC validator that a malicious DNS zone can trigger for possible RCE.
68
Vulnerability1 · 1 read
CVE-2026-81634
Heap Buffer Overflow in NLnet Labs Unbound DNS Resolver via Crafted DNS Responses
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
NLnet Labs Unbound, up to and including version 1.26.0, contains a heap buffer overflow (CWE-122) in its RRSet canonicalisation routine, where the buffer length check fails to include the first owner name. The flaw is triggered when the resolver processes a maximum-length (255-character) query name together with a large DNS response received over TCP, causing the heap buffer to overflow. A malicious actor operating a hostile authoritative name server, or an attacker able to tamper with a DNS response in transit, can trigger the condition; because canonicalisation happens before DNSSEC validation, DNSSEC does not protect affected deployments. Per the CVSS vector, the impact is availability: the resolver process can crash, producing denial of service for the clients and networks that depend on it. Anyone running Unbound as a recursive resolver or caching forwarder at version 1.26.0 or earlier is affected; no public proof-of-concept or confirmed in-the-wild exploitation is currently known.
What to do: Upgrade Unbound to a release newer than 1.26.0 as soon as NLnet Labs publishes the patched version, and monitor the vendor's advisory page for the exact fixed release. Because exploitation requires a malicious authoritative name server or an on-path attacker tampering with responses, treat upstream DNS traffic as untrusted in threat models and watch for unexplained resolver crashes or restarts as an indicator of attempted exploitation. Note that enabling or relying on DNSSEC validation does not mitigate this issue, since canonicalisation occurs before validation.
| Product | Affected |
|---|---|
| NLnet Labs Unbound | up to and including 1.26.0 |
Estimated exposure
massplausibly millions of deployments worldwide, including on the order of hundreds of thousands of internet-exposed Unbound resolvers (estimate) — Estimated from Unbound's ubiquity as an open-source recursive resolver at ISPs, enterprises, and hosting providers, its role as the default resolver in firewall distributions such as pfSense and OPNsense, and internet-wide scans that…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.
In the news
2 storiesUbuntu fixes Unbound denial-of-service flaws in USN-8946-1
Crafted TCP connections or DNS responses can exhaust resources or crash Unbound; fixed package versions are not in the excerpt.
42