{"id":2925,"date":"2026-09-17T14:02:59","date_gmt":"2026-09-17T14:02:59","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2925"},"modified":"2026-09-17T14:02:59","modified_gmt":"2026-09-17T14:02:59","slug":"critical-unbound-dnssec-validator-flaw-could-allow-rce-via-a-malicious-dns-zone","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2925","title":{"rendered":"Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Sep 17, 2026<\/span><\/span>Vulnerability \/ DNS Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory<\/a> on Wednesday.<\/p>\n

An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution.<\/p>\n

Unbound 1.26.1, released the same day, fixes the bug, tracked as CVE-2026-81642<\/a>, along with eight other flaws. One of the eight, CVE-2026-82717<\/a>, is a heap corruption bug in CNAME synthesis reported by Ben Morris of Anthropic. It could also lead to remote code execution \u00abunder certain systems and compilation options,\u00bb NLnet Labs said.<\/p>\n

NLnet Labs has not reported exploitation of either bug, and CISA’s entry for CVE-2026-81642 marked exploitation as \u00abnone\u00bb on Wednesday.<\/p>\n

NLnet Labs rates the DNSKEY flaw Critical, with a CVSS score of 4.0 (9.1), and its scoring lists a network attack vector requiring no privileges or user interaction. NVD listed the CVE as \u00abAwaiting Analysis\u00bb on Wednesday, so the 9.1 is the maintainer’s own score.<\/p>\n

The overflow happens while the validator digests a DNSKEY record whose owner name is a compression pointer into the record’s own data. The impact NLnet Labs lists is denial of service, with remote code execution possible \u00abthrough attacker controlled data.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Every version up to and including 1.26.0 is affected. That includes 1.25.2, the security release from July, and 1.26.0, released on August 4. The Critical validator bug NLnet Labs fixed in May, CVE-2026-33278<\/a>, is a different flaw, and the 1.25.1 update that fixed it does not fix this one.<\/p>\n

<\/p>\n

NLnet Labs attaches no configuration condition to that range, and it has not said whether a resolver with DNSSEC validation switched off is reachable.<\/p>\n

Upgrade or Patch<\/h3>\n

Unbound 1.26.1<\/a> is available as source, with checksums and a PGP signature, and as Windows installers and binaries. If you cannot upgrade, the advisory gives two ways to patch the source tree:<\/p>\n