Security1 publisher2 min readPublished
A crafted DNSKEY overflows the heap in every Unbound release before 1.26.1
NLnet Labs shipped Unbound 1.26.1 on Wednesday with nine CVEs fixed, among them a DNSSEC validator overflow an attacker reaches with one query into a zone he controls. Debian's stable branches are still waiting.
The Watch · Security desk
What happened
- An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, which NLnet Labs says enables remote code execution.
- Every version up to and including 1.26.0 is affected, including 1.25.2 from July and 1.26.0 from August 4, and the fix is in 1.26.1 alongside eight other CVEs.
- Debian's tracker listed unbound 1.26.1-1 as fixed in unstable on Thursday, with bookworm, trixie and forky still listed as vulnerable.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Operators on Debian stable branches choose between building 1.26.1 from source, applying the standalone patch to a 1.26.0 tree with patch -p1, or holding at a vulnerable version until the branch updates.
- constraint Teams that run Unbound with validation disabled cannot rule themselves out of the affected set: the advisory does not name a configuration that puts a resolver outside the version range.
- capability Patch diffs for the two code execution bugs are published and tested against 1.26.0, so anyone building an exploit now starts from the fix rather than from fuzzing the validator.
- contradiction NLnet Labs' impact field leads with denial of service and hedges code execution, while its own Critical 9.1 sits ahead of any NVD analysis.
A compression pointer is a wire-format shortcut: a name can point back into earlier bytes of a message instead of repeating them. Here the owner name of a DNSKEY record points into that same record's data, and Unbound's validator overflows the heap while digesting the key [8]. The precondition is a zone the attacker controls and a query that reaches the resolver [2]. NLnet Labs' own scoring lists a network attack vector with no privileges and no user interaction [6].
The impact line in the advisory leads with denial of service and puts code execution behind a condition, "through attacker controlled data" [9]. The other code execution candidate in the batch, CVE-2026-82717, is a heap corruption bug in CNAME synthesis reported by Ben Morris of Anthropic, and NLnet Labs says it could lead to remote code execution "under certain systems and compilation options" [4]. Two of the nine CVEs in 1.26.1 carry a code execution caveat [21]. NVD had the DNSKEY flaw at "Awaiting Analysis", so the 9.1 is the maintainer's number [7].
Package users have to wait for their distribution to ship 1.26.1. Debian's tracker listed unbound 1.26.1-1 as fixed in unstable on Thursday, with bookworm, trixie and forky still vulnerable [16]. The release is out as source with checksums and a PGP signature, and as Windows installers and binaries [13]. For trees that cannot change version, the advisory ships a standalone patch for CVE-2026-81642 applied with patch -p1 and then make install, or a combined patch covering all nine fixes [14]. NLnet Labs says the standalone patches for CVE-2026-81642 and CVE-2026-82717 have been tested on 1.26.0 [15].
Yuqi Qiu reported the bug on August 11, having found it with Xiang Li at Nankai University's AOSP Lab. NLnet Labs shared a patch the next day, Qiu verified it on August 13, and the fix shipped five weeks later in the 1.26.1 batch [18]. A tested fix therefore sat unreleased for roughly 35 days [20]. NLnet Labs' security policy says that for issues not yet public it aims to release fixes "in the order of weeks" [19].
val-clean-additional is now off, so 1.26.1 no longer validates DNSSEC data in the additional section of a response by default [17].
NLnet Labs has not reported exploitation of either bug, and CISA's entry for CVE-2026-81642 marked exploitation as "none" on Wednesday [5]. The affected range comes with no configuration caveat. Whether a resolver with DNSSEC validation switched off is reachable, NLnet Labs has not said [12]. May's Critical validator fix, CVE-2026-33278, is a different flaw, and 1.25.1 does not fix this one [11].
What to watch
- Security updates for Debian bookworm, trixie and forky, and whether other distributions ship 1.26.1 before a public proof of concept appears.
- NVD's analysis of CVE-2026-81642 and whether its score lands at NLnet Labs' 9.1.
- A first report of exploitation or CISA moving CVE-2026-81642 off an exploitation status of "none".