--- schema: 1 kind: vulnerability title: "CVE-2026-81642 / CVE-2026-82717 — NLnet Labs Unbound: a self-referencing DNSSEC compression pointer overflows the validator's digest buffer, reaching remote code execution (CVSS4.0 9.1 / 8.4)" headline: "Unbound's DNSSEC validator can be pointed at attacker-controlled memory by a malicious zone it was only asked to resolve" summary: > NLnet Labs fixed two heap-corruption vulnerabilities in Unbound 1.26.1 (all versions through 1.26.0 affected): CVE-2026-81642, a DNSSEC-validator digest-buffer overflow triggered by a DNSKEY record whose owner name uses a self-referencing compression pointer, and CVE-2026-82717, a companion CNAME-synthesis heap overflow during upstream response processing. Both can reach remote code execution; NCSC Switzerland records exploitation status as unknown. Any DNSSEC-validating resolver that can be made to resolve an attacker-registered zone must patch to 1.26.1 now. discovered_at: "2026-09-19T04:35:00Z" updated_at: null event_date: "2026-09-16" run_id: 2026-09-19T0409Z-intel priority: high immediate_action: null tags: [vulnerabilities, rce, pre-auth, patch-available] regions: [global] sectors: [public-sector, technology] entities: [] techniques: [T1190, T1499] affected_products: ["NLnet Labs Unbound"] cves: - id: CVE-2026-81642 cvss: "9.1 (CVSS4.0)" epss: null type: rce vector: zero-click auth: pre-auth status: [patch-available] affected: "≤ 1.26.0" fixed: "1.26.1" - id: CVE-2026-82717 cvss: "8.4 (CVSS4.0)" epss: null type: rce vector: zero-click auth: pre-auth status: [patch-available] affected: "≤ 1.26.0" fixed: "1.26.1" sources: - url: "https://nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt" publisher: "NLnet Labs" date: "2026-09-16" role: primary - url: "https://nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt" publisher: "NLnet Labs" date: "2026-09-16" role: primary - url: "https://security-hub.ncsc.admin.ch/#/posts/12957" publisher: "NCSC Switzerland (Cyber Security Hub)" date: "2026-09-18" role: corroborating - url: "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-82717" publisher: "NVD/NIST" date: "2026-09-19" role: corroborating closed_sources: [] evidence: - quote: "A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound." publisher: "NLnet Labs" - quote: "Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution." publisher: "NLnet Labs" - quote: "Prerequisites: Resolver must have DNSSEC validation active, and query routing must allow the attacker's malicious DNS zone to be parsed." publisher: "NCSC Switzerland (Cyber Security Hub)" verification: multi-source sourcing_note: null confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 1 watchlist_hit: false actions: - "Patch every DNSSEC-validating Unbound resolver to 1.26.1 now — normal recursive resolution against any attacker-registered or attacker-controlled zone is sufficient to reach a vulnerable resolver, whether or not the resolver is otherwise exposed to the open internet." updates: [] migrated_from: null --- NLnet Labs shipped Unbound 1.26.1 on 2026-09-16, fixing two heap-corruption vulnerabilities in the widely deployed open-source validating/recursive DNS resolver; every version up to and including 1.26.0 is affected ([NLnet Labs, 2026-09-16](https://nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt)). CVE-2026-81642 (CVSS4.0 9.1, found by Yuqi Qiu and Xiang Li of Nankai University's AOSP Lab) sits in the DNSSEC validator: a DNSKEY record whose owner name carries a compression pointer that references back into its own RDATA can overflow the digest buffer during DNSKEY digesting, and NLnet Labs states "remote code execution is possible through attacker controlled data" — triggered simply by having a vulnerable Unbound query a zone the attacker controls ([NLnet Labs, 2026-09-16](https://nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt)). CVE-2026-82717 (CVSS4.0 8.4 per NLnet Labs' own CNA scoring, [mirrored on NVD](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-82717); found by Ben Morris of Anthropic) is a companion bug in CNAME synthesis: when Unbound rewrites a maximum-TTL value into the packet buffer during upstream-response processing, a compression pointer that now references the overwritten, invalidated domain name sends the code down an error path that fails to advance the buffer position correctly, producing a heap overflow NLnet Labs describes as "heavily reliant on heap memory layout" and capable of remote code execution "under specific systems and compilation options" ([NLnet Labs, 2026-09-16](https://nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt)). NCSC Switzerland's advisory records exploitation status as unknown for both and notes the operative precondition plainly: "resolver must have DNSSEC validation active, and query routing must allow the attacker's malicious DNS zone to be parsed" ([NCSC Switzerland, 2026-09-18](https://security-hub.ncsc.admin.ch/#/posts/12957)) — a normal condition for any DNSSEC-validating resolver doing open recursive resolution against the internet, not an edge case. **Defender takeaway:** the prerequisite for CVE-2026-81642 is not exposure to attacker-initiated connections but DNSSEC validation plus the ability to recurse into an attacker-registered domain — a condition most validating recursive resolvers meet by design, since resolving arbitrary domains on request is their job. Patch to 1.26.1 now rather than waiting for confirmed exploitation; CVE-2026-82717's outcome is more heap-layout- and build-dependent, so a crash/DoS is the more likely near-term observable even without full RCE, but it shares the same fix and the same urgency. Detection concept: `unbound`/`named`-style crash-loops or repeated resolver-process restarts that correlate with resolution of an unusual or newly registered authoritative zone are the closest available behavioral signal in the absence of a public proof-of-concept; no PoC was found at time of writing. **Triage:** ordinary DNSSEC validation failures (a misconfigured zone, an expired signature) produce a `SERVFAIL` response and a logged validation error, not a resolver crash — a `named`/`unbound` worker process terminating or restarting during or immediately after resolving a specific external zone is the discriminator that separates this from routine DNSSEC validation noise.