REDHAT-BUG-2535059: Nlnet Labs Unbound vulnerability

Q: What does an attacker need to exploit this issue?

The attacker needs control of a malicious DNS zone and must be able to cause a vulnerable Unbound instance to query that zone. The exploit uses a crafted DNSKEY whose owner compression pointer refers to its own RDATA.

Q: Which Unbound versions are affected?

NLnet Labs Unbound versions up to and including 1.26.0 are identified as vulnerable.

Q: Is exploitation limited to denial of service?

No. The malformed DNSKEY can cause a digest-buffer overflow leading to denial of service, and attacker-controlled data may also permit remote code execution.

Q: Are vendor fixes referenced for this issue?

The provided references include Red Hat advisories RHSA-2026:70754, RHSA-2026:71459, and RHSA-2026:71419.

Published Sep 16, 2026

Updated

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.

Affected Software

1 affected component

Nlnet Labs Unbound<=1.26.0

Event History

Sep 16, 2026

Data Sourced

via Red Hat·09:07 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs control of a malicious DNS zone and must be able to cause a vulnerable Unbound instance to query that zone. The exploit uses a crafted DNSKEY whose owner compression pointer refers to its own RDATA.

Which Unbound versions are affected?

NLnet Labs Unbound versions up to and including 1.26.0 are identified as vulnerable.

Is exploitation limited to denial of service?

No. The malformed DNSKEY can cause a digest-buffer overflow leading to denial of service, and attacker-controlled data may also permit remote code execution.

Are vendor fixes referenced for this issue?

The provided references include Red Hat advisories RHSA-2026:70754, RHSA-2026:71459, and RHSA-2026:71419.

REDHAT-BUG-2535059: Nlnet Labs Unbound vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Unbound versions are affected?

Is exploitation limited to denial of service?

Are vendor fixes referenced for this issue?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Unbound versions are affected?

Is exploitation limited to denial of service?

Are vendor fixes referenced for this issue?