NLnet Labs releases Unbound 1.26.1 to fix critical DNSSEC validator flaw

September 17, 2026 at 05:30 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

NLnet Labs released Unbound 1.26.1 on Wednesday to fix a critical heap overflow in the DNS resolver's DNSSEC validator, tracked as CVE-2026-81642. The flaw affects every release before 1.26.1 and could allow remote code execution by an attacker controlling a malicious DNS zone. The update also addresses eight other vulnerabilities, including a high-severity CNAME synthesis bug reported by Anthropic's Ben Morris.

Key Facts

CVE-2026-81642 is a critical heap overflow in Unbound's DNSSEC validator affecting all versions up to and including 1.26.0.
Unbound 1.26.1, released on Wednesday, fixes CVE-2026-81642 and eight other flaws, including CVE-2026-82717.
NLnet Labs rates CVE-2026-81642 with a CVSS score of 9.1 and lists a network attack vector requiring no privileges or user interaction.
CISA's entry for CVE-2026-81642 marked exploitation as "none" on Wednesday, and NLnet Labs has not reported exploitation of either bug.
Debian's security tracker listed unbound 1.26.1-1 as fixed in unstable on Thursday, while bookworm, trixie, and forky branches remain vulnerable.

The Vulnerability

The heap overflow occurs while the validator digests a DNSKEY record whose owner name is a compression pointer into the record's own data. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger the flaw, enabling remote code execution. NLnet Labs lists the impact as denial of service, with remote code execution possible "through attacker controlled data." The affected range includes 1.25.2, the security release from July, and 1.26.0, released on August 4. NLnet Labs attaches no configuration condition to that range and has not said whether a resolver with DNSSEC validation switched off is reachable.

Patch and Mitigation

Unbound 1.26.1 is available as source with checksums and a PGP signature, and as Windows installers and binaries. For users who cannot upgrade, NLnet Labs provides minimal and complete patches for CVE-2026-81642 alone, applied with patch -p1. A combined patch for all nine fixes is also available, along with a minimal version of it. NLnet Labs says the standalone patches for CVE-2026-81642 and CVE-2026-82717 have been tested and work on 1.26.0. The maintainer's security policy is to patch the latest released version.

Related Flaws

CVE-2026-82717 is a high-severity heap corruption bug in CNAME synthesis reported by Ben Morris of Anthropic. It could also lead to remote code execution "under certain systems and compilation options," according to NLnet Labs. The Critical validator bug fixed in May, CVE-2026-33278, is a different flaw, and the 1.25.1 update that fixed it does not fix CVE-2026-81642. NVD listed CVE-2026-81642 as "Awaiting Analysis" on Wednesday, so the 9.1 score is the maintainer's own.