Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Summary: NLnet Labs disclosed a critical heap overflow in the DNSSEC validator of every Unbound DNS resolver release before 1.26.1, which an attacker controlling a malicious zone can trigger to achieve remote code execution; version 1.26.1, released the same day, fixes CVE-2026-81642 along with eight other flaws. The overflow occurs while the validator processes a DNSKEY record whose owner name is a compression pointer into the record's own data, and the bug was reported on August 11 by Yuqi Qiu and Xiang Li of Nankai University's AOSP Lab, with a patch shared the next day and the fix shipping five weeks later.
What's compelling: NLnet Labs rates the flaw 9.1 with a network attack vector requiring no privileges or user interaction, and every version through 1.26.0 is affected, including the July security release 1.25.2 and 1.26.0 from August 4 - while Debian's bookworm, trixie, and forky branches were still listed as vulnerable.
Read the original at The Hacker News ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2026-33278CVE-2026-81642CVE-2026-82717
- Related
- ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, Click Fix Attacks, Click Fix Surge, and Browser Hijacks Cyber Risks ·Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026