High severity7.5NVD Advisory· Published Sep 16, 2026· Updated Sep 23, 2026
CVE-2026-81634
CVE-2026-81634
Description
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10- osv-coords8 versionspkg:rpm/almalinux/python3-unboundpkg:rpm/almalinux/unboundpkg:rpm/almalinux/unbound-anchorpkg:rpm/almalinux/unbound-develpkg:rpm/almalinux/unbound-dracutpkg:rpm/almalinux/unbound-libspkg:rpm/almalinux/unbound-utilspkg:rpm/opensuse/unbound&distro=openSUSE%20Tumbleweed
< 1.16.2-5.14.el8_10.4+ 7 more
- (no CPE)range: < 1.16.2-5.14.el8_10.4
- (no CPE)range: < 1.16.2-5.14.el8_10.4
- (no CPE)range: < 1.24.2-7.el10_2.6
- (no CPE)range: < 1.16.2-5.14.el8_10.4
- (no CPE)range: < 1.24.2-7.el10_2.6
- (no CPE)range: < 1.16.2-5.14.el8_10.4
- (no CPE)range: < 1.24.2-7.el10_2.6
- (no CPE)range: < 1.26.1-1.1
Patches
Vulnerability mechanics
References
1- www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txtnvdPatchVendor Advisory
News mentions
1- Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS ZoneThe Hacker News · Sep 17, 2026