Unbound DNSSEC Heap Overflow Puts Vulnerable Resolvers at Risk of Remote Code Execution

NLnet Labs has fixed a critical memory-corruption vulnerability in Unbound that can be triggered through a malicious DNS zone. The flaw affects every Unbound version before 1.26.1 and may allow denial of service or remote code execution on a vulnerable resolver.

Tracked as CVE-2026-81642, the vulnerability carries a CVSS 4.0 score of 9.1 and is classified as a heap-based buffer overflow under CWE-122. The CVE Program record was published and updated on September 16, 2026.

Unbound 1.26.1 contains the correction. It also fixes eight other CVEs, including a separate heap-corruption issue that may permit code execution in some environments.

A malicious DNSKEY record can corrupt heap memory

CVE-2026-81642 resides in Unbound’s DNSSEC validator, the component responsible for authenticating DNS data using cryptographic signatures and chains of trust.

The vulnerable condition is reached when Unbound processes a specially constructed DNSKEY record. Its owner name contains a DNS compression pointer directed into the same record’s RDATA rather than a valid external location. When the validator digests this malformed structure, it can write beyond the allocated heap buffer.

The attacker needs control of a malicious DNS zone and a way to make the targeted Unbound resolver query that zone. The attack is network-reachable and does not require credentials or user interaction.

A successful attempt can crash the resolver, causing denial of service. Because the overwritten memory contains attacker-controlled data, remote code execution is also considered possible. The complete CVSS 4.0 vector assigned by NLnet Labs is:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Red

The affected range in the authoritative CVE Program record is Unbound from version 0 through all releases before 1.26.1. That includes 1.25.2 and 1.26.0, the latter released on August 4.

Upgrading to 1.25.1 is not sufficient. That release corrected CVE-2026-33278, a different critical DNSSEC-validator vulnerability, while CVE-2026-81642 remained present through 1.26.0.

No exploitation has been reported

NLnet Labs has not reported attacks exploiting CVE-2026-81642. Available CISA data also described its exploitation status as “none.” It has not been established that the vulnerability is in CISA’s Known Exploited Vulnerabilities catalog, and no KEV remediation deadline is known.

There are likewise no reported exploitation indicators for administrators to search for. That limits incident-response guidance to conventional resolver telemetry, including unexplained crashes, restarts, memory-corruption errors and suspicious query sequences involving unfamiliar zones.

The absence of known exploitation does not reduce the technical impact. A resolver may contact attacker-controlled authoritative infrastructure during normal DNS resolution, and the vulnerability can be reached without an authenticated connection to the Unbound service.

Yuqi Qiu, working with Xiang Li at Nankai University’s AOSP Lab, reported the defect to NLnet Labs on August 11. NLnet Labs supplied a patch the next day, and the reporter verified it on August 13. Both researchers are credited as finders.

Version 1.26.1 closes nine security flaws

CVE-2026-81642 is the most severe of nine vulnerabilities addressed in Unbound 1.26.1. Several others depend on specific build flags, protocol listeners or resolver configuration.

The second memory-safety concern is CVE-2026-82717, a high-severity heap-corruption flaw triggered during CNAME synthesis in an upstream response. It affects versions through 1.26.0 and can cause denial of service. Code execution may be possible on certain systems and with particular compilation options. No exploitation has been reported.

The remaining fixes are:

• CVE-2026-81634, rated 7.5, can crash versions through 1.26.0 when a 255-character query name is combined with a large TCP response from a malicious name server or a tampered response.
• CVE-2026-77955, rated 4.4, affects versions 1.13.2 through 1.26.0 when zonemd-check: yes is configured below, but not at, a trust anchor. It can cause denial of service and briefly allow tampered zone data to be served before the ZONEMD check.
• CVE-2026-78227, rated 6.5, affects versions 1.22.0 through 1.26.0 built with --with-libngtcp2 and configured with quic-port. Its reported impact is denial of service.
• CVE-2026-80225, rated 5.3, allows service degradation through a sustained stream of distinct, uncached names sent over one TCP or DNS-over-TLS connection.
• CVE-2026-82720, rated 5.9, affects versions 1.12.0 through 1.26.0 built with --with-libnghttp2 and configured with https-port. It can produce a limited denial of service.
• CVE-2026-85501, rated 5.3, concerns ReTrap algorithmic-complexity techniques, including TagTrap, DelegationTrap, NsecTrap and AdditionalTrap. Malicious zones can use them to degrade resolver performance.
• CVE-2026-77860 is a low-severity issue affecting versions 1.20.0 through 1.26.0. The serve-expired path can bypass a DNSBomb countermeasure and contribute to a pulsing denial-of-service amplification attack.

As part of the ReTrap remediation, Unbound now disables val-clean-additional by default. Consequently, DNSSEC data in the additional section of a response is no longer validated by default.

Upgrade or apply the vendor patches

Administrators should install Unbound 1.26.1 rather than relying on configuration changes. NLnet Labs provides source code, checksums, a PGP signature, Windows installers and Windows binaries for the corrected release.

Operators unable to upgrade immediately can apply a source-tree patch. Available options include minimal and complete patches for CVE-2026-81642, as well as combined patches covering all nine vulnerabilities. An example installation sequence is:

patch -p1 < patch_CVE-2026-81642_with.diff
make install

NLnet Labs tested the standalone patches for CVE-2026-81642 and CVE-2026-82717 against Unbound 1.26.0. Compatibility with other release branches has not been specified.

Disabling DNSSEC validation should not be treated as a confirmed workaround. There is no established vendor guidance showing that this configuration change reliably prevents the vulnerable code path. The documented remedies are upgrading or patching.

Distribution packages may remain behind upstream

The presence of an upstream fix does not mean every operating-system repository already contains it. Debian listed unbound 1.26.1-1 as fixed in unstable on Thursday, while bookworm, trixie and forky were still marked vulnerable.

Administrators should inspect the actual package version installed on each resolver instead of relying solely on routine update status. Inventories should also cover appliances, embedded deployments, containers and DNS services maintained outside standard operating-system repositories.

Build and runtime settings require separate review. Deployments using --with-libngtcp2, --with-libnghttp2, quic-port, https-port, zonemd-check or serve-expired face exposure to additional flaws corrected in the same release.

Internet-facing recursive resolvers and systems processing queries influenced by untrusted users should receive priority. After patching, operators should confirm that the running daemon—not merely the package database—reports version 1.26.1 or an appropriately patched build.