Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

A critical heap overflow vulnerability exists in Unbound DNS resolver versions before 1.26.1, enabling remote code execution when an attacker controls a malicious DNS zone. The vulnerability, identified as CVE-2026-81642, allows an attacker to trigger the overflow by querying a vulnerable resolver. NLnet Labs, the maintainer of Unbound, released version 1.26.1 on August 4th to address this issue. The vulnerability occurs when the DNSSEC validator digests a DNSKEY record whose owner name is a compression pointer into the record's own data. NLnet Labs rates the DNSKEY flaw Critical, with a CVSS score of 4.0 (9.1), and its scoring lists a network attack vector requiring no privileges or user interaction. Versions up to and including 1.26.0 are affected, including 1.25.2 and 1.26.0. The bug was reported on August 11th by Yuqi Qiu and Xiang Li at Nankai University's AOSP Lab, and a patch was released the next day, with verification occurring on August 13th, and finally incorporated into 1.26.1 five weeks later. Debian's security tracker lists unbound 1.26.1-1 as fixed in unstable. The vulnerability also includes CVE-2026-82717, a heap corruption bug in CNAME synthesis, which also leads to remote code execution under certain conditions. A separate patch addresses the ReTrap fix, which changes a default setting to disable DNSSEC validation of the additional section of a response. NLnet Labs’ security policy is to patch the latest released version.