Unbound: 1.26.1 addresses multiple CVE items
Unbound 1.26.1 fixes critical heap buffer overflow CVE-2026-81642 in DNSKEY digesting that may allow remote code execution.
NLnet Labs released Unbound 1.26.1 on September 16 as a security release fixing several vulnerabilities, most notably CVE-2026-81642, rated CRITICAL, a heap buffer overflow during DNSKEY digesting that can possibly lead to remote code execution. Unbound is a widely deployed DNS recursive resolver and validating resolver. Administrators should upgrade promptly.
- CVE-2026-81642 rated critical: heap buffer overflow in DNSKEY digesting
- Possible remote code execution via crafted DNSKEY data
- Unbound 1.26.1 released September 16 with fixes
- Unbound is widely used for recursive and validating DNS
- CVEs
- CVE-2026-81642
- Vendors
- NLnet Labs
- Products
- Unbound
- Organizations
- NLnet Labs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-81642 | Heap buffer overflow in NLnet Labs Unbound DNSKEY digesting enables DoS and RCE | 9.1 | <1% | PoC |
From the original article
Posted by Yorgos Thessalonikefs on Sep 16 Hi there, https://community. nlnetlabs. nl/t/unbound-1-26-1-released/3463) Several vulnerabilities were found in Unbound.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.