Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
NLnet Labs patched a critical heap overflow (CVE-2026-81642) in Unbound's DNSSEC validator that a malicious DNS zone can trigger for possible RCE.
68
Vulnerability1 · 1 read
CVE-2026-82720
Use-After-Free in NLnet Labs Unbound DNS-over-HTTPS Can Crash Resolver
- CVSS 3.1
- 5.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
NLnet Labs Unbound versions 1.12.0 through 1.26.0 contain a use-after-free (CWE-416) in the DNS-over-HTTPS code path, but only when the binary was compiled with the '--with-libnghttp2' option. When a failure occurs on one DoH stream - such as an RPZ rule dropping a query or session jostling under heavy client traffic - the entire DoH session is torn down without properly accounting for the other streams in that session, resulting in use-after-free accesses. An attacker who can satisfy the prerequisites (an RPZ drop rule in place or heavy client traffic) can trigger the flaw with a single DoH connection and appropriate traffic; the reads are not attacker-controlled and typically lead only to early returns, but a hardened allocator can detect the invalid access and deliberately terminate the process, causing denial of service. Only operators running DoH-enabled Unbound builds are affected, and confidentiality and integrity are not impacted. No public proof-of-concept or in-the-wild exploitation is known and the flaw is not in CISA KEV; it is distinct from the separately headlined Unbound DNSSEC validator RCE issue.
What to do: Check whether your unbound binary was built with '--with-libnghttp2' (visible via 'unbound -V'); if so, upgrade to the newest NLnet Labs release after 1.26.0 that contains the fix. As interim mitigation, avoid RPZ 'drop' actions on DoH-facing instances or terminate DoH in a front-end proxy in front of unbound, and run unbound under a supervisor (e.g., systemd with automatic restart) so a triggered crash results only in a brief outage.
| Product | Affected |
|---|---|
| NLnet Labs Unbound | 1.12.0 through 1.26.0 (inclusive), when compiled with '--with-libnghttp2' for DNS-over-HTTPS support |
Estimated exposure
largelikely tens of thousands of DoH-enabled Unbound deployments (order of magnitude 10k-100k systems) — Unbound is one of the most widely deployed open-source recursive DNS resolvers across ISPs, enterprises and appliances, but the flaw requires the relatively uncommon '--with-libnghttp2' compile-time option, so only a small subset of the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.