CVE-2026-81642

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.1

Description A heap-based buffer overflow exists in the DNSSEC validator of the Unbound DNS resolver. The issue occurs during the preparation of a DNSKEY digest within the ds create dnskey digest() function located in validator/val sigcrypt.c. An attacker controlling a malicious DNS zone can trigger this by providing a DNSKEY record where the owner compression pointer refers to its own RDATA. This causes the validator to decompress the data into a buffer without a proper capacity check, leading to a memory boundary crossing. This can result in a denial of service or possible remote code execution (RCE) within the resolver process, requiring no target credentials or user interaction.

Recommendations Update to version 1.26.1. Restrict recursion to intended clients and review network paths to minimize exposure. Remove unnecessary service privileges and restrict writable paths and egress to limit the impact of potential code execution.