Critical severity9.8NVD Advisory· Published Sep 16, 2026· Updated Sep 22, 2026
CVE-2026-81642
CVE-2026-81642
Description
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10- osv-coords8 versionspkg:rpm/almalinux/python3-unboundpkg:rpm/almalinux/unboundpkg:rpm/almalinux/unbound-anchorpkg:rpm/almalinux/unbound-develpkg:rpm/almalinux/unbound-dracutpkg:rpm/almalinux/unbound-libspkg:rpm/almalinux/unbound-utilspkg:rpm/opensuse/unbound&distro=openSUSE%20Tumbleweed
< 1.16.2-5.14.el8_10.4+ 7 more
- (no CPE)range: < 1.16.2-5.14.el8_10.4
- (no CPE)range: < 1.16.2-5.14.el8_10.4
- (no CPE)range: < 1.24.2-7.el10_2.6
- (no CPE)range: < 1.16.2-5.14.el8_10.4
- (no CPE)range: < 1.24.2-7.el10_2.6
- (no CPE)range: < 1.16.2-5.14.el8_10.4
- (no CPE)range: < 1.24.2-7.el10_2.6
- (no CPE)range: < 1.26.1-1.1
Patches
Vulnerability mechanics
References
1- www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txtnvdMitigationPatchVendor Advisory
News mentions
2- ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser HijacksThe Hacker News · Sep 21, 2026
- Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS ZoneThe Hacker News · Sep 17, 2026