CVE-2026-81642 is a critical (9.8) heap overflow in the DNSSEC validator of NLnet Labs Unbound up to and including 1.26.0. A crafted DNSKEY can overflow the digest buffer, causing denial of service and possibly remote code execution. NLnet Labs fixed it in Unbound 1.26.1.
What's affected
NLnet Labs lists Unbound up to and including 1.26.0 as affected. Unbound 1.26.1 contains the fix, which checks the buffer's capacity after decompression and before writing.
For people who build from source, the advisory also provides two patch files for 1.26.0: a full one and a minimal one that addresses only this vulnerability. Both are tested against 1.26.0 according to the advisory.
How to check if you're exposed
Check the version of the resolver you run.
unbound -V
Then check how Unbound got onto the host. Distributions often ship their own builds with backported fixes, so a version string alone may mislead.
dpkg -l unbound 2>/dev/null
rpm -q unbound 2>/dev/null
Unbound is also bundled inside appliances and container images, so look there too. If your distribution has published its own advisory for this CVE, follow it.
What to do now
- Find every Unbound resolver, including those bundled in appliances and container images.
- Upgrade to Unbound 1.26.1 or a distribution build that carries the fix.
- If you build from source and cannot upgrade yet, NLnet Labs publishes patch files for 1.26.0 on the advisory page.
- Restart the service after patching and confirm the version.
- Limit who can query your resolver, so only your own clients reach it.
Why it matters
The weakness is CWE-122, heap-based buffer overflow. According to the advisory, a DNSKEY record can carry a compression pointer to its own data, and the digest code then writes more than its buffer holds.
The attack path is unusual and worth understanding. The attacker controls a malicious DNS zone and needs a vulnerable Unbound to look it up. A resolver that answers queries from many clients can be induced to do that. DNS resolvers sit on the path of nearly all traffic from a network, so a flaw that can reach code execution gets a critical score. The record is not listed in CISA's KEV catalog, and the advisory does not report exploitation.
This flaw is a good reminder that resolvers are infrastructure. Unbound often runs on a gateway, a firewall appliance or a container in a cluster, and nobody thinks of it as an application. Start your search with the places that bundle it, not only the hosts where you installed it by hand.
The trigger in the advisory is a lookup against a malicious zone. That does not require the attacker to reach your resolver directly. It requires only that something in your environment asks the resolver for a name in the attacker's zone. A user clicking a link, a mail server checking a domain, or a script resolving a hostname can all do that. This is why limiting who can query the resolver reduces risk but does not remove it.
If you cannot move to 1.26.1 this week, NLnet Labs provides patch files for 1.26.0 on its advisory page, including a minimal one that addresses only this issue. Apply the patch to the source tree and run make install, as the advisory describes, then restart the service. Remember CVE-2026-82717 is fixed in the same release.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does my resolver need to be public to be at risk?
No. The attacker needs your resolver to look up a name in their zone. Any resolver that serves clients who can request arbitrary names can be induced to do that.
Sources
Last reviewed: 19 October 2026.
