CVE-2026-82717
HighCVSS 8.4Summary
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce (rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow.
Risk Assessment
Memory corruption can lead to service crashes and, under specific conditions, remote code execution, posing a serious threat to system integrity.
Recommendation
Update Unbound to a version later than 1.26.0 that includes a fix for this vulnerability.
Other vulnerabilities in NLnet Labs Unbound
See all- CVE-2026-81634High
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation) can trigger the vulnerability.
- CVE-2026-55973High
Vulnerability in NLnet Labs Unbound (versions 1.23.0 to 1.25.1) with 'dns-error-reporting: yes' enabled allows an attacker to remotely crash the daemon by sending a crafted upstream response. The bug occurs when processing the EDNS Report-Channel option.
Original NVD description (English source)
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.