CVE-2026-82717 – NLnet Labs Unbound
“When your DNS resolver can be turned against you by a single poisoned answer, every lookup becomes an open door.”
This update patches three heap buffer overflows in NLnet Labs Unbound through version 1.26.0. All three can lead to remote code execution. CVE-2026-81642 has a CVSS score of 9.1, Critical severity. An attacker who controls a malicious zone can send a crafted DNSKEY that overflows the DNSSEC validator's digest buffer, causing denial of service or remote code execution. CVE-2026-82717 has a CVSS score of 8.4, High severity. Crafted CNAME synthesis combined with a compression pointer progressively corrupts heap memory, crashes the resolver, and on certain systems and builds allows remote code execution. CVE-2026-81634 has a CVSS score of 7.5, High severity. A maximum-length query name paired with a large TCP response overflows the heap during RRSet canonicalisation.
Each of these flaws is triggered by attacker-controlled DNS responses, and canonicalisation runs before DNSSEC validation, so DNSSEC does not block the attack. Any Unbound resolver that queries untrusted name servers is exposed and should be updated right away.
Key Details
- Affected Product
- Nlnetlabs Unbound
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-122