CVE-2026-81642

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

Published: Sep 16, 2026Updated: Sep 22, 2026 Sources: CVE List NVDCWE-122

9.8CRITICAL

Description

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.

In plain language

AI Act now

unbound 1.26.0 or earlier can be taken over or knocked offline by a malicious DNS zone, so businesses running it with DNSSEC validation enabled should act now.

Executive summary

Heap buffer overflow in unbound’s DNSSEC validator while digesting a crafted DNSKEY with a self-referential compression pointer, enabling unauthenticated network DoS and possible RCE.

If affected, business impact

DNS resolver outageServer takeoverNetwork disruptionService downtime

What to do now

Check whether your DNS resolver runs unbound, whether DNSSEC validation is enabled, and whether its version is 1.26.0 or earlier.
Upgrade unbound to version 1.26.1.
If you cannot upgrade promptly, apply the vendor’s temporary workaround and restrict the resolver to trusted networks.
Review resolver crashes and unusual DNS responses after remediation.

Patch / advisory Usually a quick update

What is it

unbound is software that helps your network look up internet addresses safely. This flaw is like a maliciously prepared address-book entry causing the receptionist’s filing cabinet to break open, potentially stopping service or letting an intruder control the desk.

Who is affected

This matters to you if you run unbound as a DNS resolver. It is only a risk when DNSSEC validation is enabled and an attacker controls a malicious DNS zone or can inject records that unbound will validate.

How urgent is it

Attackers do not need an account or a person to click anything to trigger this over the network. No real-world exploitation or public exploit code has been reported, but the potential for server takeover and the easy attack path make this a red-priority fix.

What to do — in detail

Confirm exposure by checking each DNS resolver’s unbound version and configuration for DNSSEC validation. Upgrade all affected installations to 1.26.1; the vendor identifies 1.26.1 as the fixed release, with no branch-specific alternatives provided. Test the upgrade through your normal package or build process, then restart the resolver and confirm it reports the updated version. If patching is delayed, use the vendor workaround at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt and limit resolver access to trusted networks where operationally possible. This issue is not listed in CISA KEV, so there is no CISA remediation due date. Monitor for resolver crashes, unexpected restarts, and unusual DNS responses from zones being validated.

Technical context

CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CWE-122 heap-based buffer overflow in DNSSEC DNSKEY digest handling: a self-referential owner compression pointer can overflow the digest buffer with attacker-controlled data, causing DoS and possible RCE. The attack vector is network-based, requires no authentication or user interaction, and is reachable in the default configuration when DNSSEC validation is enabled. CISA KEV does not list this CVE; no confirmed exploitation, incidents, or public exploit code are reported. EPSS is 0.5% (43rd percentile) and flat.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-122

Affected Products

nlnetlabs

oss-project

unboundOn-premNetwork Device

Networking Infrastructure / dns-dhcp-ntp

NLnet Labs

oss-projectaka bcder, routinator, unbound

UnboundOn-prem

Networking Infrastructure / dns-dhcp-ntp

Exploitability

Official Patch Available

Workaround Available

Is your org exposed to CVE-2026-81642?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Privilege Escalation

View detailed technique mapping

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt

nlnetlabs.nl

News mentions

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-81642 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows