CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Unboundto a version that resolves this vulnerability.Fixed in 1.26.1
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Unbound deployments up to and including 1.26.0 are exposed when they process a 255-length query name and receive a large TCP DNS response. The issue occurs during RRSet canonicalisation before DNSSEC validation.
What access does an attacker need?
An attacker can trigger the issue by operating a malicious name server that supplies the response, or by tampering with an incoming response to Unbound. No privileges or user interaction are required according to the supplied vector.
Does DNSSEC validation prevent exploitation?
No. Canonicalisation takes place before DNSSEC validation, so the malformed response can trigger the heap buffer overflow before DNSSEC checks occur.