BREAKING: Unbound DNSKEY digest overflow can RCE your resolver (1.26.1)

Your recursive DNS resolver can take attacker-controlled data from a malicious zone and overflow a digest buffer while validating DNSKEY records. NLnet Labs shipped Unbound 1.26.1 today (2026-09-16) with a same-day CVE batch. The lead issue is CVE-2026-81642: a heap overflow in the DNSSEC validator when digesting DNSKEYs, with possible remote code execution through attacker-controlled data. An adversary who controls a malicious zone only needs a vulnerable Unbound to query it.

This is the operator write-up for the 1.26.1 upgrade train. The HOL Guard evidence pack for CVE-2026-81642 is the source record. Sibling packs for the same release sit under Guard as well; do not open a second blog post for this train.

What breaks

Vendor advisory for CVE-2026-81642: a DNSKEY whose owner name uses a compression pointer into its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker-controlled data. Unbound 1.26.1 checks buffer capacity after decompression and before writing.

That bug is not alone. The same 1.26.1 tarball also closes other same-day Unbound CVEs that share the upgrade:

• CVE-2026-82717: CNAME synthesis that rewrites a max TTL in the packet buffer, plus a bad compression pointer, can progressively corrupt heap memory. Under some systems and compilation options that can become RCE. Disclosed by Ben Morris (Anthropic).
• CVE-2026-81634: a 255-length query name with a large TCP response can heap-overflow during RRSet canonicalisation before DNSSEC validation. Triggerable from a malicious name server or a tampered response.
• CVE-2026-82720: use-after-free on DoH stream cleanup when Unbound is built --with-libnghttp2. Failure paths (RPZ drop, jostle under load) can free a session while other streams remain. Reads are not attacker-controlled; a hardened allocator can turn this into DoS. Affects 1.12.0 through 1.26.0 with DoH.
• CVE-2026-85501: ReTrap algorithmic DNSSEC complexity attacks (TagTrap, DelegationTrap, NsecTrap, AdditionalTrap). 1.26.1 adds match/operation/NSEC caps and defaults val-clean-additional to off.
• CVE-2026-80225: unbounded consecutive TCP/DoT reads let a client monopolize one worker's event loop with distinct uncached names.
• CVE-2026-78227: DoQ use-after-free when built --with-libngtcp2 (1.22.0-1.26.0): RESET_STREAM frees the stream output buffer while ngtcp2 still holds retransmission pointers.
• CVE-2026-77955: ZONEMD zones below a trust anchor (zonemd-check: yes) can briefly serve or write tampered contents before verification finishes (1.13.2-1.26.0).
• CVE-2026-77860: serve-expired double-decrements the per-client wait-limit, weakening the DNSBomb countermeasure from CVE-2024-33655 (1.20.0-1.26.0).

Affected line for the RCE-class DNSKEY and CNAME bugs: Unbound up to and including 1.26.0. Fixed line: Unbound 1.26.1 (unbound-1.26.1.tar.gz). Distro packages will lag; treat anything still reporting 1.26.0 or older as in the blast radius until you confirm the patch.

Who is not in scope

Resolvers that are not Unbound (BIND, Knot Resolver, PowerDNS Recursor, systemd-resolved, cloud recursive anycast) are outside this advisory set. Unbound already on 1.26.1 is outside. CVE-2026-82720 does not apply if you never built with --with-libnghttp2 / DoH. CVE-2026-78227 does not apply without --with-libngtcp2 / DoQ. CVE-2026-77955 only hits operators who enable zonemd-check: yes on zones below a trust anchor. CVE-2026-77860 only bites when serve-expired is on. Stub resolvers and authoritative-only Unbound deployments that never recurse into attacker zones still need the binary upgrade for the shared code paths, but the practical DNSKEY/CNAME RCE story is recursive validation against a hostile zone.

How to check

On every Unbound host (and every container image that embeds it):

unbound -V | head -n 5
# or
unbound -V 2>&1 | grep -E 'Version|linked libs|libnghttp2|ngtcp2'

Confirm the printed Version is 1.26.1 or newer. Also note whether the build line mentions libnghttp2 or ngtcp2; those flags decide whether 82720 / 78227 were reachable on that binary. Package managers:

dpkg -l unbound 2>/dev/null | awk '/^ii/ {print $2,$3}'
rpm -q unbound 2>/dev/null
# FreeBSD / ports style
pkg info unbound 2>/dev/null | head

If your fleet runs Unbound behind Ansible, Puppet, or a distro mirror, inventory the running binary version, not just the package name on the mirror metadata. A host still answering on 1.26.0 after the mirror shows 1.26.1 is still vulnerable.

How to fix

Upgrade Unbound to 1.26.1 and restart the service. Prefer the vendor tarball or your distro's patched package once it lands:

# source build (vendor)
curl -fsSL -O https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz
tar xf unbound-1.26.1.tar.gz && cd unbound-1.26.1
./configure && make && sudo make install
sudo systemctl restart unbound
unbound -V | head -n 1

For Unbound 1.26.0 source trees that cannot jump packages yet, NLnet Labs published per-CVE patches (full and minimal) next to each advisory on nlnetlabs.nl/downloads/unbound/. Apply with patch -p1 then make install. Operators should still prefer the full 1.26.1 release so every sibling in this batch lands together.

After upgrade, re-check unbound -V, confirm workers are on the new binary (systemctl status unbound / process start time), and watch recursion logs for unusual DNSSEC failures from zones you do not own. If you expose DoH or DoQ, treat those listeners as in-scope until the build flags and version both clear.

What this is not

This is not a confirmed in-the-wild worm as of the vendor notes we used (the advisories do not claim active exploitation). It is not "any DNS software." It is not automatic RCE on every Unbound install: CVE-2026-81642 and CVE-2026-82717 need a path where Unbound digests or synthesizes against attacker-influenced zone data, and 82717's RCE path is layout- and build-dependent. DoH/DoQ UAFs need those features compiled in. ReTrap and the TCP/DoT read starvation bugs are availability and resource-abuse stories, not the same as the DNSKEY digest RCE. Still: Unbound is widely deployed recursive DNS. Same-day vendor RCE language on the resolver that answers for your network is enough to treat 1.26.1 as an emergency upgrade.

References

• NLnet Labs advisory CVE-2026-81642
• NLnet Labs advisory CVE-2026-82717
• NLnet Labs advisory CVE-2026-82720
• NLnet Labs advisory CVE-2026-85501
• NLnet Labs advisory CVE-2026-81634
• NLnet Labs advisory CVE-2026-80225
• NLnet Labs advisory CVE-2026-78227
• NLnet Labs advisory CVE-2026-77955
• NLnet Labs advisory CVE-2026-77860
• Unbound 1.26.1 source tarball
• HOL Guard pack CVE-2026-81642