Summary
Yuqi Qiu and Xiang Li discovered that Unbound did not correctly handle
certain memory operations. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. (CVE-2026-81642)
Ben Morris discovered that Unbound did not correctly handle certain
memory operations. An attacker could possibly use this issue to cause a
denial of service or execute arbitary code. (CVE-2026-82717)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | unbound | 1.13.1-1ubuntu5.16 |
| Ubuntu · 24.04 LTS 24.04:LTS | unbound | 1.19.2-1ubuntu3.10 |
| Ubuntu · 26.04 LTS 26.04:LTS | unbound | 1.24.2-1ubuntu2.3 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | unbound | 1.4.22-1ubuntu4.14.04.3+esm4 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | unbound | 1.5.8-1ubuntu1.1+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | unbound | 1.6.7-1ubuntu2.6+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | unbound | 1.9.4-2ubuntu1.11+esm2 |
Vulnerabilities 2
-
Critical 9.1CVE-2026-81642 Public exploit
Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA…
-
High 8.4
CNAME synthesis could lead to heap corruption
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis duri…