Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
NLnet Labs patched a critical heap overflow (CVE-2026-81642) in Unbound's DNSSEC validator that a malicious DNS zone can trigger for possible RCE.
Unbound 1.26.1, released September 17, fixes nine CVEs, including critical heap overflow CVE-2026-81642 (CVSS 9.1) in the DNSSEC validator, which affects every version through 1.26.0 and can be triggered by an attacker controlling a malicious zone that serves a DNSKEY record with a compression pointer into its own data, causing denial of service and possibly remote code execution. CVE-2026-82717, a heap corruption in CNAME synthesis reported by Ben Morris of Anthropic, could also lead to RCE under certain systems and compilation options. NLnet Labs has not reported exploitation and CISA marks CVE-2026-81642 exploitation as none; standalone and combined patches are available alongside the 1.26.1 release.
- CVE-2026-81642: critical heap overflow in DNSSEC validator, CVSS 9.1, all versions through 1.26.0 affected
- Triggered by a DNSKEY record whose owner name is a compression pointer into its own data
- CVE-2026-82717 heap corruption in CNAME synthesis may also enable RCE under certain build options
- No exploitation reported; CISA lists CVE-2026-81642 exploitation as none
- Fixed in Unbound 1.26.1; standalone and combined source patches available
- CVEs
- CVE-2026-81642CVE-2026-82717CVE-2026-81634CVE-2026-77955CVE-2026-78227CVE-2026-80225CVE-2026-82720CVE-2026-85501CVE-2026-77860CVE-2026-33278
- Vendors
- NLnet LabsDebian
- Products
- Unbound
- Organizations
- NLnet LabsCISANVDAnthropicNankai University
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-33278 | NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote… | 9.1 | 1% | ||
| CVE-2026-81642 | Heap buffer overflow in NLnet Labs Unbound DNSKEY digesting enables DoS and RCE | 9.1 group max | <1% | PoC |
From the original article
3 min read at thehackernews.com
Every release of the Unbound DNS resolver before 1. 26. 1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.