NLnet Labs has released Unbound version 1.26.1 to address CVE-2026-81642, a critical flaw in its DNSSEC validator that carries risks of service disruption and potential remote code execution. The vulnerability impacts all versions through 1.26.0 and activates when the resolver processes a malicious DNS zone.
The issue lies in the DNSSEC validator during handling of DNSKEY records. Specifically, the code can experience a buffer overflow when managing data from incoming DNS responses, a scenario made more serious because the traffic arrives over the network and the process typically runs continuously.
The vendor assigned the vulnerability a CVSS 4.0 score of 9.1, with a network vector, no privileges required, and no user interaction. An attacker must control a malicious DNS zone and cause the vulnerable resolver to query it. This can occur if the resolver accepts queries from untrusted networks, resolves for external users, or is tricked into querying the attacker-controlled domain.
In the worst scenario, the manipulated input can not only trigger denial of service but also open the door to remote code execution using data controlled by the attacker. No active exploitation in the wild had been observed at the time of disclosure.
Unbound 1.26.1 adds a proper buffer capacity check after decompression and before writing data. The release also bundles eight additional security fixes, including CVE-2026-82717 involving heap corruption during CNAME synthesis and CVE-2026-81634 related to possible heap overflow during DNSSEC canonicalization.
Administrators are advised to update to Unbound 1.26.1 immediately. Where immediate updates are not possible, apply the official patch for CVE-2026-81642, recompile, and plan full adoption of all fixes. Organizations should also inventory Unbound instances in appliances, containers, and distribution packages to confirm the running version includes the equivalent patch.
