Unbound: 1.26.1 addresses multiple CVE items
Unbound 1.26.1 fixes critical heap buffer overflow CVE-2026-81642 in DNSKEY digesting that may allow remote code execution.
NLnet Labs released Unbound 1.26.1 on September 16 as a security release fixing several vulnerabilities, most notably CVE-2026-81642, rated CRITICAL, a heap buffer overflow during DNSKEY digesting that can possibly lead to remote code execution. Unbound is a widely deployed DNS recursive resolver and validating resolver. Administrators should upgrade promptly.
- CVE-2026-81642 rated critical: heap buffer overflow in DNSKEY digesting
- Possible remote code execution via crafted DNSKEY data
- Unbound 1.26.1 released September 16 with fixes
- Unbound is widely used for recursive and validating DNS
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-81642 | Heap buffer overflow in NLnet Labs Unbound DNSKEY digesting enables DoS and RCE Unbound, NLnet Labs' widely used validating recursive DNS resolver, contains a buffer overflow (CWE-122) in the DNSSEC validator's DNSKEY digesting routine. A crafted DNSKEY record whose owner name uses a compression pointer back into its own RDATA overflows the digest buffer while the resolver is validating the zone. An attacker who controls a malicious authoritative zone and can cause a vulnerable Unbound resolver to query it can crash the service (denial of service) and, using attacker-controlled data, potentially achieve remote code execution on the resolver host. All Unbound deployments up to and including version 1.26.0 that perform DNSSEC validation are affected. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not in CISA's KEV catalog. Do: Upgrade Unbound to the patched release announced by NLnet Labs (any version beyond 1.26.0 containing the fix) as soon as it is available, and confirm the running version with 'unbound -V'. Until patching, restrict recursion to trusted clients, monitor NLnet Labs' advisory for fixed versions and workarounds, and treat unexplained resolver crashes or restarts as suspicious. | 9.1 | — |
| massmillions of installations worldwide, including hundreds of thousands of internet-reachable Unbound resolvers seen in public scans |
Posted by Yorgos Thessalonikefs on Sep 16 Hi there, https://community.nlnetlabs.nl/t/unbound-1-26-1-released/3463) Several vulnerabilities were found in Unbound. We are releasing 1.26.1 as a security release today (September 16) including the relevant fixes. The overview of the vulnerabilities with a brief description is: CVE-2026-81642 - severity: CRITICAL Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY...
This source does not provide full text. Read it at seclists.org.