NLnet Labs has released Unbound 1.26.1 to address nine security vulnerabilities, including a critical DNSSEC validation flaw that could potentially allow remote code execution when a vulnerable resolver processes data from an attacker-controlled DNS zone.
The most severe issue, tracked as CVE-2026-81642, affects all Unbound releases through version 1.26.0. According to the vendor, the flaw is a heap overflow in DNSSEC validation logic involving DNSKEY records and a crafted compression pointer. A remote attacker controlling a malicious zone could trigger the condition by causing a vulnerable resolver to query that zone.
NLnet Labs rated the vulnerability critical and assigned it a CVSS score of 9.1. The stated impact includes denial of service and possible code execution through attacker-controlled data. As of the advisory's publication, neither NLnet Labs nor CISA had reported known exploitation.
The update also resolves CVE-2026-82717, a high-severity heap corruption issue associated with CNAME synthesis. NLnet Labs said this flaw may also enable code execution in certain environments, depending on operating system and compilation settings.
Other fixes in the release
Unbound 1.26.1 includes patches for additional denial-of-service and service-degradation issues affecting TCP, DNS-over-TLS, HTTP/2, QUIC, ZONEMD validation, serve-expired handling, and algorithmic-complexity attacks against malicious DNS zones.
- CVE-2026-81634 addresses a denial-of-service condition involving long query names and large TCP responses.
- CVE-2026-80225 mitigates service degradation caused by sustained requests for distinct uncached names over TCP or DNS-over-TLS.
- CVE-2026-85501 addresses ReTrap-style DNS complexity attacks, including TagTrap and DelegationTrap variants.
- CVE-2026-77860 fixes a serve-expired path that could contribute to pulsing denial-of-service amplification.
The release also changes the default setting for val-clean-additional, disabling DNSSEC validation of data in the additional section of responses by default.
Recommended action
Organizations running Unbound should upgrade to version 1.26.1 as soon as practical. NLnet Labs has made source packages, signatures, checksums, Windows binaries, and standalone or combined source patches available. Administrators unable to immediately upgrade can apply the vendor-provided patch for CVE-2026-81642, although updating to the full release addresses all nine reported issues.