Heap overflow in Unbound DNSSEC validator
Heap overflow in Unbound's DNSSEC validator affects all releases before 1.26.1. A malicious DNS zone can trigger potential RCE on the querying resolver.
- Vendor
- NLnet Labs
- Product
- Unbound
- CVSS
- 9.1
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
CVE-2026-81642 is a heap overflow in the DNSSEC validator of Unbound, the open-source validating recursive DNS resolver maintained by NLnet Labs. The flaw is triggered when the validator processes a DNSKEY record whose owner name contains a compression pointer that resolves back into the same record’s data. This can overflow a heap buffer, potentially enabling remote code execution if the attacker controls a DNS zone that the vulnerable resolver queries.
All Unbound releases before 1.26.1 are affected. NLnet Labs patched the issue in Unbound 1.26.1, released September 17, 2026. A targeted minimal patch for CVE-2026-81642 alone is also available from NLnet Labs for operators who cannot immediately deploy the full release. No active exploitation has been reported as of the advisory date.
A related flaw, CVE-2026-82717 (heap corruption in CNAME synthesis), was also patched in 1.26.1.
