CVE-2026-82717

Unbound is software that helps computers find the internet addresses behind website and service names. A malicious DNS response can make it write information into the wrong place, like forcing extra paperwork into an already-full filing drawer until the office system stops working—or, in some cases, allowing an intruder to take control of the server.

This matters to you if you run Unbound as a DNS resolver on a server, firewall, network appliance, or managed infrastructure. It does not require an attacker to sign in or a staff member to click anything; it is a risk when an attacker can send crafted DNS traffic into Unbound's processing stream.

Attackers can send specially crafted network traffic that may crash the DNS service or take over its server, making this a high-priority fix. No confirmed real-world exploitation or public exploit code is currently reported, but the service is reachable in its default configuration and the impact can be severe.

Confirm the running version with your operating system's package manager or unbound -V, then locate every Unbound resolver, including appliance and container deployments. Versions through 1.26.0 are affected; upgrade to 1.26.1 or a vendor package that incorporates that fix, following the vendor's normal package or appliance update path.

Before deployment, back up the active Unbound configuration and test the update on a non-production resolver where possible. The findings provide no breaking-change warning for this update. If patching must wait, limit recursive DNS access and upstream response exposure to trusted networks as far as operationally practical.

CISA has not added this CVE to the Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date. After upgrading, watch for Unbound crashes, unexpected restarts, abnormal DNS resolution failures, and unusual malformed-response errors; investigate any signs that predate the upgrade.

CVE-2026-82717 is CWE-122 heap-based buffer overflow / heap corruption reachable over the network without authentication or user interaction and reachable in Unbound's default configuration. The triggering path involves CNAME synthesis during upstream DNS response processing, maximum-TTL rewriting, and malformed compression pointers that cause an error path to mishandle the packet-buffer position. The resulting capability is denial of service and, depending on heap layout, system, and compilation options, potential remote code execution. It is not listed in CISA KEV; no confirmed exploitation, dated exploitation claim, or public exploit code is recorded. EPSS is 0.4% (34th percentile) with a flat trend.