CVE-2026-81642

Unbound, NLnet Labs' widely used validating recursive DNS resolver, contains a buffer overflow (CWE-122) in the DNSSEC validator's DNSKEY digesting routine. A crafted DNSKEY record whose owner name uses a compression pointer back into its own RDATA overflows the digest buffer while the resolver is validating the zone. An attacker who controls a malicious authoritative zone and can cause a vulnerable Unbound resolver to query it can crash the service (denial of service) and, using attacker-controlled data, potentially achieve remote code execution on the resolver host. All Unbound deployments up to and including version 1.26.0 that perform DNSSEC validation are affected. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not in CISA's KEV catalog.

What to do: Upgrade Unbound to the patched release announced by NLnet Labs (any version beyond 1.26.0 containing the fix) as soon as it is available, and confirm the running version with 'unbound -V'. Until patching, restrict recursion to trusted clients, monitor NLnet Labs' advisory for fixed versions and workarounds, and treat unexplained resolver crashes or restarts as suspicious.