2026-09-19 · view entry permalink →
CVE-2026-81642 / CVE-2026-82717, NLnet Labs Unbound: a self-referencing DNSSEC compression pointer overflows the validator's digest buffer, reaching remote code execution (CVSS4.0 9.1 / 8.4)
NLnet Labs shipped Unbound 1.26.1 on 2026-09-16, fixing two heap-corruption vulnerabilities in the widely deployed open-source validating/recursive DNS resolver; every version up to and including 1.26.0 is affected (NLnet Labs, 2026-09-16). CVE-2026-81642 (CVSS4.0 9.1, found by Yuqi Qiu and Xiang Li of Nankai University's AOSP Lab) sits in the DNSSEC validator: a DNSKEY record whose owner name carries a compression pointer that references back into its own RDATA can overflow the digest buffer during DNSKEY digesting, and NLnet Labs states "remote code execution is possible through attacker controlled data", triggered simply by having a vulnerable Unbound query a zone the attacker controls (NLnet Labs, 2026-09-16). CVE-2026-82717 (CVSS4.0 8.4 per NLnet Labs' own CNA scoring, mirrored on NVD; found by Ben Morris of Anthropic) is a companion bug in CNAME synthesis: when Unbound rewrites a maximum-TTL value into the packet buffer during upstream-response processing, a compression pointer that now references the overwritten, invalidated domain name sends the code down an error path that fails to advance the buffer position correctly, producing a heap overflow NLnet Labs describes as "heavily reliant on heap memory layout" and capable of remote code execution "under specific systems and compilation options" (NLnet Labs, 2026-09-16). NCSC Switzerland's advisory records exploitation status as unknown for both and notes the operative precondition plainly: "resolver must have DNSSEC validation active, and query routing must allow the attacker's malicious DNS zone to be parsed" (NCSC Switzerland, 2026-09-18), a normal condition for any DNSSEC-validating resolver doing open recursive resolution against the internet, not an edge case.
Triage: ordinary DNSSEC validation failures (a misconfigured zone, an expired signature) produce a SERVFAIL response and a logged validation error, not a resolver crash, a named/unbound worker process terminating or restarting during or immediately after resolving a specific external zone is the discriminator that separates this from routine DNSSEC validation noise.
A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.
Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.
Prerequisites: Resolver must have DNSSEC validation active, and query routing must allow the attacker's malicious DNS zone to be parsed.