Unbound DNS: patch 1.26.1 fixes critical code execution flaw

NLnet Labs, the organisation that maintains the Unbound DNS resolver, published an advisory on Wednesday warning that every version of the software released before 1.26.1 carries a critical heap overflow in its DNSSEC validator. A DNS resolver is the software that looks up a domain name and returns the matching internet address, so it sits between users and almost every website they reach. DNSSEC is a set of cryptographic signatures that let a resolver prove an answer really came from the owner of a domain. A heap overflow means a program writes more data into a section of memory than that section was sized to hold, which corrupts whatever sits next to it. The flaw is tracked as CVE-2026-81642.

According to the advisory, an attacker who controls a malicious zone and queries a vulnerable resolver can trigger the overflow. The detail matters: the overflow happens while the validator digests a DNSKEY record whose owner name is a compression pointer into the record's own data. DNSKEY records hold the public keys used to sign a zone, and a compression pointer is a short reference that tells a parser to reuse a name it has already read earlier in the same message. NLnet Labs lists the impact as denial of service, meaning the resolver can be knocked out of action, with remote code execution possible through attacker controlled data. Remote code execution is the more serious outcome, because it means an attacker can get the machine to run code of their choosing.

NLnet Labs rates the bug Critical with a CVSS score of 4.0 (9.1). CVSS is a standard way of scoring how severe a vulnerability is, and the advisory's scoring describes a network attack vector that requires no privileges and no user interaction, so the attacker needs no account on the machine and no help from the victim. The United States National Vulnerability Database listed the CVE as "Awaiting Analysis" on Wednesday, which means the 9.1 figure is the maintainer's own assessment rather than one that has been independently reviewed.

The 1.26.1 release fixes eight further flaws alongside CVE-2026-81642. One of them, CVE-2026-82717, is a heap corruption bug in CNAME synthesis, which is how a resolver builds a CNAME answer, the DNS record type that points one name at another. NLnet Labs credits the report to Ben Morris of Anthropic and rates the issue High, saying it could also lead to remote code execution under certain systems and compilation options. Neither bug has been reported as exploited, and CISA, the United States Cybersecurity and Infrastructure Security Agency, marked exploitation of CVE-2026-81642 as "none" in its entry for the CVE on Wednesday.

Every version up to and including 1.26.0 is affected, which takes in 1.25.2, the security release from July, and 1.26.0, released on August 4. The Critical validator bug NLnet Labs fixed in May, CVE-2026-33278, is a different flaw, and the 1.25.1 update that fixed it does not fix this one, so anyone who patched back in May still has work to do. NLnet Labs attaches no configuration condition to the affected range, and it has not said whether a resolver with DNSSEC validation switched off is reachable.

Unbound 1.26.1 is available as source, with checksums and a PGP signature, and as Windows installers and binaries. Checksums and a PGP signature let an administrator confirm that a download arrived intact and genuinely came from the maintainer. Teams that cannot upgrade straight away have another route: the advisory gives two ways to patch the source tree. One is to apply the minimal patch or the complete patch for CVE-2026-81642 alone with patch -p1, for example patch -p1 < patch_CVE-2026-81642_with.diff, then run make install. The other is to apply the combined patch covering all nine fixes instead, and a minimal version of that combined patch also exists. NLnet Labs says the standalone patches for CVE-2026-81642 and CVE-2026-82717 have been tested and work on 1.26.0. Its security policy is to patch the latest released version, which explains why older branches are not receiving separate fixes.

Linux distributions are still catching up. Debian's security tracker listed unbound 1.26.1-1 as fixed in unstable on Thursday, with the bookworm, trixie and forky branches still listed as vulnerable. That means a machine on a stable Debian branch may still be running a vulnerable resolver even though the fix exists upstream, so administrators should watch their distribution's security tracker instead of assuming an update has already arrived.

The other fixes in the batch cover a range of problems. CVE-2026-81634 is rated High: a 255-length query name combined with a large TCP response, arriving from a malicious name server or a tampered response, causes denial of service. CVE-2026-77955 is Medium and reaches back to version 1.13.2 and up to and including 1.26.0: in zones configured with zonemd-check yes, a window exists in which tampered zone data is served before the ZONEMD check runs. CVE-2026-78227, Medium and affecting 1.22.0 up to and including 1.26.0, affects builds compiled with --with-libngtcp2 and a quic-port configured, which can be pushed into denial of service.

The remaining entries are all Medium or Low. CVE-2026-80225 affects versions up to and including 1.26.0, where a sustained stream of distinct uncached names over a single TCP or DoT connection degrades service. CVE-2026-82720, from 1.12.0 up to and including 1.26.0, affects builds made with --with-libnghttp2 and an https-port configured, with an impact NLnet Labs calls limited. CVE-2026-85501, up to and including 1.26.0, covers malicious zones serving ReTrap algorithmic complexity attacks named as TagTrap, DelegationTrap, NsecTrap and AdditionalTrap. CVE-2026-77860, Low and affecting 1.20.0 up to and including 1.26.0, sits in the serve-expired code path, where it bypasses a countermeasure added for DNSBomb and could take part in a pulsing denial of service amplification attack. One change is a default rather than a repair: the ReTrap fix turns val-clean-additional off, so Unbound no longer validates DNSSEC data in the additional section of a response by default. The additional section holds extra records a resolver did not strictly ask for.

The validator bug was reported to NLnet Labs on August 11 by Yuqi Qiu, who found it with Xiang Li at Nankai University's AOSP Lab, according to the timeline in the CVE record. NLnet Labs shared a patch the next day and the reporter verified it on August 13. The fix shipped five weeks later in the 1.26.1 batch. NLnet Labs' security policy says that for issues that are not yet public it aims to release fixes "in the order of weeks".

For website owners and IT teams, the practical question is who runs the resolver. Unbound is widely used by hosting companies, internet providers and businesses that keep their own DNS infrastructure, and a resolver handling many customers is a more interesting target than a single laptop. If you do not run Unbound yourself, ask whoever