Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-16T08:30:15 unbound: Unbound: Heap buffer overflow via malicious DNSSEC response 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-122

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.

A flaw was found in Unbound. This vulnerability allows a remote attacker to cause a heap buffer overflow during the processing of DNSSEC responses. By sending a specially crafted DNSSEC response, a malicious server or an attacker tampering with network traffic can trigger this flaw. This could lead to a denial of service, making the Unbound service unavailable.

This is an Important flaw where Unbound, when acting as a recursive DNS resolver, is vulnerable to a heap buffer overflow. A remote attacker could exploit this by operating a malicious name server or by intercepting and manipulating DNS responses, potentially leading to a denial of service or arbitrary code execution. This risk is heightened in deployments where Unbound processes queries from untrusted sources. Red Hat Enterprise Linux 10 2026-09-24T00:00:00Z RHSA-2026:71419 unbound-0:1.24.2-7.el10_2.6 Red Hat Enterprise Linux 8 2026-09-23T00:00:00Z RHSA-2026:70754 unbound-0:1.16.2-5.14.el8_10.4 Red Hat Enterprise Linux 9 2026-09-24T00:00:00Z RHSA-2026:71487 unbound-0:1.24.2-3.el9_8.8 Red Hat Hardened Images 2026-09-17T00:00:00Z RHSA-2026:68590 unbound-main-1.26.1-1.hum1 Red Hat Enterprise Linux 6 Out of support scope unbound Red Hat Enterprise Linux 7 Affected unbound Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-81634 https://nvd.nist.gov/vuln/detail/CVE-2026-81634 https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt