Unbound 1.26.0 and prior contain heap overflow in DNSSEC validator via compressed DNSKEY pointers
A critical heap overflow in Unbound's DNSSEC validator allows RCE from malicious zones. The bug affects every release through 1.26.0 and was fixed in 1.26.1 with no observed exploitation. Infrastructure operators must upgrade rapidly to close the exposure window created by distribution lag.
Operational impact centers on any validating resolver that accepts queries from untrusted sources. Recursive operators running 1.26.0 or earlier must apply the supplied minimal patch or upgrade immediately. Sustained scanning for the affected versions is expected within days. Future releases will need stricter input validation on DNSKEY and CNAME processing to prevent similar pointer-based overflows.
NLnet Labs: Within 60 days, at least 40 percent of public Unbound resolvers will report version 1.26.1 or newer via version.bind queries.
Sources (2)
- [1]Primary Source(https://nlnetlabs.nl/projects/unbound/security-advisories/)
- [2]Supporting Source(https://nvd.nist.gov/vuln/detail/CVE-2026-81642)