Unbound 1.26.1 patches critical DNSKEY RCE and eight other flaws

Unbound 1.26.1, released as a security update by NLnet Labs, closes nine vulnerabilities, including a critical heap buffer overflow that can allow remote code execution when the resolver digests DNSKEY records.

Unbound is a widely deployed validating, recursive, and caching DNS resolver used by operators who want DNSSEC validation and modern transports such as DNS-over-TLS, DNS-over-HTTPS, and DNS-over-QUIC. A remote code execution flaw in DNSKEY handling is especially serious for any internet-facing recursive resolver: an attacker who can supply crafted DNSSEC material could potentially take over the process.

CVE-2026-81642 (Critical) is a heap buffer overflow with possible remote code execution when digesting DNSKEY data. Two high-severity issues follow: CVE-2026-81634, a possible heap buffer overflow during DNSSEC canonicalization, and CVE-2026-82717, where CNAME synthesis could lead to heap corruption.

Five medium-severity flaws address a possible ZONEMD verification bypass window, use-after-free bugs in DoQ stream output on reset retransmission and in DoH stream cleanup, degradation of service from continuous queries on the same TCP or DoT connection, and algorithmic complexity attacks on DNSSEC (Retrap). A low-severity issue allows serve-expired to bypass Unbound’s wait-limit.

Yorgos Thessalonikefs announced the release on behalf of the Unbound team and pointed operators to the project’s security advisories for full detail. Anyone running Unbound in production should treat 1.26.1 as a priority upgrade.