CVE-2026-81642

Published Sep 16, 2026

Last updated a month ago

CVSS critical 9.1

Overview

Description
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.
Source
sep@nlnetlabs.nl
NVD status
Analyzed
Products
unbound

Risk scores

CVSS 4.0

Type
Secondary
Base score
9.1
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red
Severity
CRITICAL

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

sep@nlnetlabs.nl
CWE-122

Social media

Hype score
Not currently trending

  1. ثغرة حرجة في مُحلِّل النطاقات مفتوح المصدر تسمح بتنفيذ كود عن بُعد عبر نطاق خبيث يستهدف مدقق التوقيعات. المعرّف : CVE-2026-81642 درجة الخطورة : 9.1 (CVSS) - Critical الإص

    @KasperskyDev

    20 Sept 2026

    207 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Unbound 1.26.1 soluciona CVE-2026-81642, una vulnerabilidad crítica que permite provocar una caída y podría facilitar la ejecución remota de código. https://t.co/QlK3Y2eofv #Unbound #DNSSEC #CVE202681642 https://t.co/A4Z5LEE2d5

    @UktusNas

    19 Sept 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Unboundの脆弱性情報が公開されました（CVE-2026-81642、他8件） https://t.co/QZIc3xgyll

    @JPRS_official

    18 Sept 2026

    309 Impressions

    1 Retweet

    5 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Unbound DNSSEC validator before 1.26.1 has a critical heap overflow that can enable remote code execution via a malicious DNS zone. Version 1.26.1 fixes CVE-2026-81642 and other flaws. #Unbound #CVE-2026-81642 #NLnetLabs https://t.co/X8Wse5Vyhy

    @TweetThreatNews

    17 Sept 2026

    207 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. Critical Unbound DNSSEC bug CVE-2026-81642: malicious zone can heap-overflow resolvers before 1.26.1. DoS + possible RCE. Upgrade recursive DNS fleets; this is not just another resolver crash. #CVE #DNS #CyberSecurity Link: https://t.co/Fdw2hHti0v

    @Orion84x

    17 Sept 2026

    33 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.•CVE-2026-80225
  2. NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.•CVE-2026-82720
  3. In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.•CVE-2026-82717
  4. Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.•CVE-2026-85501
  5. In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.•CVE-2026-81634

References

Sources include official advisories and independent security research.