NLnet Labs Unbound

product · product:nlnet-labs-unbound single-source

Coverage

first 2026-09-19 → last 2026-09-30

Latest activity

2026-09-19

Unbound's DNSSEC validator can be pointed at attacker-controlled memory by a malicious zone it was only asked…

Peak priority

high

1 high

Targets

public-sector

sectors: public-sector, technology

Sources cited

3 hosts

Action items (1)

Do-now tasks recorded on the entries about NLnet Labs Unbound, newest first. Check the date before acting on an older one.

Patch every DNSSEC-validating Unbound resolver to 1.26.1 now; normal recursive resolution against any attacker-registered or attacker-controlled zone is sufficient to reach a vulnerable resolver, whether or not the resolver is otherwise exposed to the open internet.
2026-09-19CVE-2026-81642 +1

Defender insights

What each entry about NLnet Labs Unbound tells a defender to do, newest first.

2026-09-19HIGHUnbound's DNSSEC validator can be pointed at attacker-controlled memory by a malicious zone it was only asked to resolve

Defender takeaway

The prerequisite for CVE-2026-81642 is not exposure to attacker-initiated connections but DNSSEC validation plus the ability to recurse into an attacker-registered domain, a condition most validating recursive resolvers meet by design, since resolving arbitrary domains on request is their job. Patch to 1.26.1 now rather than waiting for confirmed exploitation; CVE-2026-82717's outcome is more heap-layout- and build-dependent, so a crash/DoS is the more likely near-term observable even without full RCE, but it shares the same fix and the same urgency. Detection concept: unbound/named-style crash-loops or repeated resolver-process restarts that correlate with resolution of an unusual or newly registered authoritative zone are the closest available behavioral signal in the absence of a public proof-of-concept; no PoC was found at time of writing.

Triage

Story timeline

2026-09-19CVE-2026-81642 / CVE-2026-82717: NLnet Labs Unbound, a self-referencing DNSSEC compression pointer overflows the validator's digest buffer, reaching remote code execution (CVSS4.0 9.1)
trending-vulnerabilitiesUnbound's DNSSEC validator can be pointed at attacker-controlled memory by a malicious zone it was only asked to resolve

Hunting pivots

CVEs

CVE-2026-81642 CVE-2026-82717

Releases covered

NLnet Labs Unbound

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-19/cve-2026-81642-cve-2026-82717-unbound-dnssec-rce · ATT&CK page ↗

Impact TA0040

T1499Endpoint Denial of Service×1

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.

Evidence: 2026-09-19/cve-2026-81642-cve-2026-82717-unbound-dnssec-rce · ATT&CK page ↗

Entries about NLnet Labs Unbound (1)

2026-09-19 · view entry permalink →

HIGHCVE-2026-81642 +1updatedNATOA2

CVE-2026-81642 / CVE-2026-82717: NLnet Labs Unbound, a self-referencing DNSSEC compression pointer overflows the validator's digest buffer, reaching remote code execution (CVSS4.0 9.1)

NLnet Labs released Unbound 1.26.1 as a security release on 2026-09-16, fixing nine vulnerabilities in the widely deployed open-source validating and recursive DNS resolver. It rates CVE-2026-81642 critical and CVE-2026-82717 high, and among the others a third high-rated flaw is a possible heap buffer overflow during DNSSEC canonicalization (NLnet Labs via oss-security, 2026-09-16). CVE-2026-81642 and CVE-2026-82717 affect every version up to and including 1.26.0 (NLnet Labs, 2026-09-16; NLnet Labs, 2026-09-16). CVE-2026-81642 (CVSS4.0 9.1 per NCSC Switzerland (NCSC Switzerland, 2026-09-18); found by Yuqi Qiu and Xiang Li of Nankai University's AOSP Lab) sits in the DNSSEC validator: a DNSKEY record whose owner name carries a compression pointer that references back into its own RDATA can overflow the digest buffer during DNSKEY digesting, and NLnet Labs states "remote code execution is possible through attacker controlled data", triggered simply by having a vulnerable Unbound query a zone the attacker controls (NLnet Labs, 2026-09-16). CVE-2026-82717 (found by Ben Morris of Anthropic) is a companion bug in CNAME synthesis: when Unbound rewrites a maximum-TTL value into the packet buffer during upstream-response processing, a compression pointer that now references the overwritten, invalidated domain name sends the code down an error path that fails to advance the buffer position correctly, producing a heap overflow NLnet Labs describes as "heavily reliant on heap memory layout" and capable of remote code execution "under specific systems and compilation options" (NLnet Labs, 2026-09-16). NCSC Switzerland's advisory on CVE-2026-81642 records the exploitation status as unknown and notes the operative precondition plainly: "resolver must have DNSSEC validation active, and query routing must allow the attacker's malicious DNS zone to be parsed" (NCSC Switzerland, 2026-09-18), a normal condition for any DNSSEC-validating resolver doing open recursive resolution against the internet, not an edge case.

Defender takeaway

Triage: ordinary DNSSEC validation failures (a misconfigured zone, an expired signature) produce a SERVFAIL response and a logged validation error, not a resolver crash; a named/unbound worker process terminating or restarting during or immediately after resolving a specific external zone is the discriminator that separates this from routine DNSSEC validation noise.

A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.

Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.

NLnet Labs 2026-09-16

Prerequisites: Resolver must have DNSSEC validation active, and query routing must allow the attacker's malicious DNS zone to be parsed.

NCSC Switzerland (Cyber Security Hub) 2026-09-18

Correction30 Sep 2026 07:19 UTCrun 2026-09-30T0639Z-auditsourcescvesbodytitlesummaryclassificationverificationsourcing_note

NLnet Labs rates CVE-2026-81642 critical and CVE-2026-82717 high in its release announcement, and 1.26.1 fixes nine vulnerabilities rather than the two named earlier (NLnet Labs via oss-security, 2026-09-16). The CVSS 4.0 score of 9.1 for CVE-2026-81642 is NCSC Switzerland's figure (NCSC Switzerland, 2026-09-18). No citable source publishes a CVSS score for CVE-2026-82717, so the 8.4 given for it earlier is withdrawn.

vulnerability19 Sep 04:35Zsingle-sourceOpen finding →

Sources: NLnet Labs · NCSC Switzerland (Cyber Security Hub) · NLnet Labs (Unbound 1.26.1 release announcement, oss-security list)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

Vulns1

Source distribution

nlnetlabs.nl2 (50%)
seclists.org1 (25%)
security-hub.ncsc.admin.ch1 (25%)

All cited sources (4)