Every release of the **Unbound DNS resolver** before 1.26.1 contains a critical heap overflow in its **DNSSEC** validator, as announced by maintainer **NLnet Labs** in a recent advisory. An attacker controlling a malicious zone could trigger this vulnerability by querying a susceptible resolver, potentially leading to remote code execution. **Unbound 1.26.1**, released concurrently with the advisory, addresses this critical bug, tracked as **CVE-2026-81642**, alongside eight other security flaws. Among these is **CVE-2026-82717**, a heap corruption bug in **CNAME** synthesis reported by **Ben Morris** of **Anthropic**, which could also result in remote code execution "under certain systems and compilation options," according to **NLnet Labs**. As of the advisory, **NLnet Labs** has not reported any exploitation of these vulnerabilities, and **CISA**'s entry for **CVE-2026-81642** currently lists exploitation as "none." **NLnet Labs** has rated the **DNSKEY** flaw as Critical, assigning it a **CVSS** score of 9.1 (Base Score 4.0), noting a network attack vector requiring no privileges or user interaction. The **NVD** had not yet analyzed the **CVE** at the time of the announcement, making the 9.1 score the maintainer's own assessment. The overflow occurs when the validator processes a **DNSKEY** record where the owner name is a compression pointer within the record's own data. While the primary impact listed by **NLnet Labs** is denial of service, remote code execution is possible "through attacker controlled data." All versions up to and including 1.26.0 are affected, including the July security release 1.25.2 and 1.26.0 from August 4. It's important to note that the Critical validator bug **CVE-2026-33278**, fixed in May's 1.25.1 update, is a separate issue and is not addressed by those earlier patches. **NLnet Labs** has not specified any configuration conditions for the affected range nor whether resolvers with **DNSSEC** validation disabled remain vulnerable. ### Upgrade or Patch Immediately **Unbound 1.26.1** is available for download as source code (with checksums and a **PGP** signature) and as **Windows** installers and binaries. For those unable to upgrade immediately, the advisory provides two methods to patch the source tree: * Apply the [minimal patch](https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-81642.diff) or the [complete patch](https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-81642_with.diff) for **CVE-2026-81642** alone using `patch -p1`, for example, `patch -p1 < patch_CVE-2026-81642_with.diff`, followed by `make install`. * Alternatively, apply the [combined patch](https://nlnetlabs.nl/downloads/unbound/patch_combined_with-1.26.1_v2.diff) for all nine fixes. A minimal version of this combined patch is also available. **NLnet Labs** confirms that the standalone patches for **CVE-2026-81642** and **CVE-2026-82717** have been tested and are effective on version 1.26.0. Their security policy prioritizes patching the latest released version. **Debian**'s security tracker has listed **unbound 1.26.1-1** as fixed in the unstable branch, while bookworm, trixie, and forky branches were still marked as vulnerable. ### The Nine Fixes in Detail The [release notes](https://github.com/NLnetLabs/unbound/releases/tag/release-1.26.1) detail nine **CVEs** addressed in this update. The table below summarizes each vulnerability, its severity, affected versions, trigger conditions, and potential impact: | CVE | Severity | Affected versions | Needs | Impact | | :------------- | :------- | :---------------------------- | :-------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------- | | **CVE-2026-81642** | Critical | Up to and including 1.26.0 | An attacker who controls a malicious zone and queries the resolver | Denial of service, possible remote code execution | | **CVE-2026-82717** | High | Up to and including 1.26.0 | **CNAME** synthesis during an upstream response. Code execution "under certain systems and compilation options" | Denial of service, possible remote code execution | | **CVE-2026-81634** | High | Up to and including 1.26.0 | A 255-length query name with a large **TCP** response, from a malicious name server or a tampered response | Denial of service | | **CVE-2026-77955** | Medium | 1.13.2 up to and including 1.26.0 | Zones with `zonemd-check: yes` located below, but not at, a trust anchor | Denial of service, a window where tampered zone data is served before the **ZONEMD** check | | **CVE-2026-78227** | Medium | 1.22.0 up to and including 1.26.0 | Built with `--with-libngtcp2` and `quic-port` configured | Denial of service | | **CVE-2026-80225** | Medium | Up to and including 1.26.0 | A sustained stream of distinct uncached names over one **TCP** or **DoT** connection | Degradation of service | | **CVE-2026-82720** | Medium | 1.12.0 up to and including 1.26.0 | Built with `--with-libnghttp2` and `https-port` configured. **NLnet Labs** calls the impact limited | Denial of service | | **CVE-2026-85501** | Medium | Up to and including 1.26.0 | Malicious zones serving the **ReTrap** algorithmic complexity attacks (**TagTrap**, **DelegationTrap**, **NsecTrap**, **AdditionalTrap**) | Degradation of service | | **CVE-2026-77860** | Low | 1.20.0 up to and including 1.26.0 | The `serve-expired` code path, bypassing a countermeasure added for [**DNSBomb**](https://thehackernews.com/2024/05/researchers-warn-of-catddos-botnet-and.html) | Could take part in a pulsing **DoS** amplification attack | The **ReTrap** fix also alters a default setting: `val-clean-additional` is now off, meaning **Unbound** will no longer validate **DNSSEC** data in the additional section of a response by default. The critical bug **CVE-2026-81642** was reported to **NLnet Labs** on August 11 by **Yuqi Qiu**, who discovered it with **Xiang Li** at **Nankai University**'s **AOSP Lab**. **NLnet Labs** provided a patch the following day, which the reporter verified on August 13. The fix was then shipped five weeks later as part of the 1.26.1 batch. According to **NLnet Labs**' security policy, for non-public issues, they aim to release fixes "in the order of weeks."