CVE-2026-82717 is a critical (9.8) heap corruption flaw in NLnet Labs Unbound up to and including 1.26.0. Rewriting a maximum TTL during CNAME synthesis can lead to an error path that overflows a heap buffer. It can crash the resolver, and under some builds allow remote code execution. Upgrade to 1.26.1.
What's affected
NLnet Labs lists Unbound up to and including 1.26.0 as affected. Unbound 1.26.1 includes fixes for each of the individual issues that combine into this vulnerability.
The advisory also provides patch files for 1.26.0: a full one and a minimal one limited to this vulnerability. Both are described as tested on 1.26.0. This is a separate record from CVE-2026-81642, and one upgrade covers both.
How to check if you're exposed
Check the version of the resolver you run.
unbound -V
Then check how Unbound got onto the host. Distributions often ship their own builds with backported fixes, so a version string alone may mislead.
dpkg -l unbound 2>/dev/null
rpm -q unbound 2>/dev/null
Unbound is also bundled inside appliances and container images, so look there too. If your distribution has published its own advisory for this CVE, follow it.
What to do now
- Find every Unbound resolver, including those bundled in appliances and container images.
- Upgrade to Unbound 1.26.1 or a distribution build that carries the fix.
- If you build from source and cannot upgrade yet, NLnet Labs publishes patch files for 1.26.0 on the advisory page.
- Restart the service after patching and confirm the version.
- Limit who can query your resolver, so only your own clients reach it.
Why it matters
The weakness is CWE-122, heap-based buffer overflow. The advisory describes a chain. CNAME synthesis rewrites a TTL in the packet buffer, and a compression pointer that points to the overwritten value invalidates the domain name. The resulting error path does not move the buffer position correctly, and the overflow follows.
NLnet Labs notes that the outcome depends on heap layout. The usual result is memory corruption that ends in a crash. Code execution is possible only under specific systems and compilation options. That is a fair reason to treat a crash loop in your resolver as a signal and not a nuisance. It is not listed in CISA's KEV catalog.
Heap corruption bugs reward patience on the attacker side and punishment on the operator side. The advisory says results depend on heap layout, so the first visible symptom is often a crash, followed by a restart, followed by silence. If your resolver restarts unexpectedly, look at the logs and at what it was asked just before. A crash loop is a reason to patch sooner.
The advisory describes a chain of smaller flaws that combine. It says 1.26.1 fixes each of the individual issues. That is a good sign for completeness, and it is also why partial fixes are not a substitute. If you carry a distribution patch, confirm that it covers the whole set, not only the headline change.
The NLnet Labs page gives patch files for 1.26.0, in a full and a minimal variant. Choose the minimal one only if you need the smallest possible change, and plan to move to a full release afterwards.
Quick check
Is remote code execution certain?
No. The advisory says it depends on heap layout and compilation options. The common outcome is a crash, but patch regardless.
Sources
Last reviewed: 19 October 2026.
