NLnet Labs published a security advisory on September 17 disclosing a critical heap overflow in the DNSSEC validator of every Unbound release up to and including 1.26.0 (CVE-2026-81642, CVSS 9.1). An attacker who controls a malicious DNS zone and can get a vulnerable resolver to query it can trigger the overflow, potentially achieving remote code execution. The attack requires no authentication and no user interaction — only network access to the resolver. NLnet Labs has not reported any in-the-wild exploitation, and CISA’s initial entry marks exploitation as “none,” but given the severity and the breadth of affected versions, prompt patching is essential.
The fix is in Unbound 1.26.1, released the same day. The release also addresses eight additional CVEs discovered in the same audit cycle, including CVE-2026-82717, a high-severity heap corruption in CNAME synthesis — reported by a researcher at Anthropic — that can also lead to code execution on certain platforms. The overflow in CVE-2026-81642 is triggered when the validator processes a DNSKEY record whose owner name is a compression pointer into the record’s own data; the patch prevents the invalid self-referential read. Notably, the July 2026 security release (1.25.2) and the August 2026 feature release (1.26.0) both remain vulnerable — updating to 1.26.1 is the only complete fix. If an immediate upgrade is not possible, NLnet Labs provides standalone source patches for CVE-2026-81642 and CVE-2026-82717 that apply to 1.26.0 with patch -p1.
How to check if you’re affected
Affected versions include all Unbound DNS resolver releases up to and including 1.26.0. Run unbound -V or check your package manager (e.g., apt-cache policy unbound on Debian/Ubuntu, rpm -q unbound on RHEL/Fedora) to find your installed version. On Debian stable (bookworm), testing (trixie), and Debian forky, the fixed packages had not yet landed in the stable repositories as of the advisory date — check the Debian Security Tracker for the latest package status and apply the update as soon as it is available. Systems running Unbound with DNSSEC validation enabled (the default in most distributions) and reachable from untrusted networks should be treated as highest priority.