Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in anadvisoryon Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. Unbound 1.26.1, released the same day, fixes the bug, tracked asCVE-2026-81642, along with
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
The Hacker News - 17 Sep 2026 18:00
Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in anadvisoryon Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. Unbound 1.26.1, released the same day, fixes the bug, tracked asCVE-2026-81642, along with
Share this Article
Recommended