Critical Flaw in Unbound's DNSSEC Validator Threatens Remote Code Execution

NLnet Labs, the organization behind the Unbound DNS resolver, said in a Wednesday advisory that every release up to and including 1.26.0 contains a critical heap overflow vulnerability in the DNSSEC validator. An attacker who controls a malicious zone can trigger a crash by sending a query to a vulnerable resolver — potentially all the way to remote code execution.

The bug, assigned the identifier CVE-2026-81642, arises when processing a DNSKEY record whose owner name is a compression pointer that points into the record's own data. NLnet Labs rates the vulnerability as critical, with its own CVSS score of 9.1: the network attack vector requires neither privileges nor user interaction. The NVD entry is still marked as awaiting analysis, and CISA noted on Wednesday that no cases of exploitation have been recorded. The stated impact is denial of service, with code execution possible “through attacker-controlled data.”

Release 1.26.1, which came out the same day, closes a total of nine vulnerabilities. Among them is CVE-2026-82717, a heap corruption during CNAME synthesis reported by Ben Morris of Anthropic; on certain systems and with certain compile-time settings it too can lead to RCE. The remaining defects range from high to low in severity: they include a flaw in handling long names with large TCP responses, issues in builds with libngtcp2 and libnghttp2, and a family of algorithmic attacks dubbed ReTrap (TagTrap, DelegationTrap, NsecTrap, AdditionalTrap) that cause service degradation.

Notably, the ReTrap fix changes the default behavior: the val-clean-additional setting is now disabled, and Unbound no longer validates DNSSEC data in the additional section of a response automatically.

All versions up to and including 1.26.0 are affected, including the July release 1.25.2 and the August release 1.26.0. It is separately noted that the critical validator bug fixed in May (CVE-2026-33278) is a different defect, and the 1.25.1 update does not address the current problem.

What to do

Unbound 1.26.1 is available as source code with checksums and a PGP signature, as well as installers and binaries for Windows. For those who cannot update immediately, the advisory suggests applying either the minimal or the full patch for CVE-2026-81642 via patch -p1 followed by make install, or applying the combined patch covering all nine fixes. In the Debian security tracker, version 1.26.1-1 was marked on Thursday as fixed in unstable, while the bookworm, trixie, and forky branches are still listed as vulnerable.

The bug was reported on August 11 by Yuqi Qiu, who discovered it together with Xiang Li at the AOSP lab of Nankai University. NLnet Labs submitted a patch the following day, the reporter confirmed it on August 13, and the fix shipped five weeks later as part of the 1.26.1 build.

Source: The Hacker News