UBUNTU-CVE-2026-81634: Buffer Overflow

Q: Which deployments are exposed to this issue?

Ubuntu systems running NLnet Labs Unbound up to and including version 1.26.0 are affected. Exploitation requires Unbound to process a crafted DNS response associated with a 255-byte query name and a large TCP response.

Q: What attacker position is required to trigger the overflow?

An attacker can trigger it by operating a malicious authoritative name server or by tampering with a response received by Unbound. No authentication or user interaction is required according to the supplied severity vector.

Q: Does DNSSEC validation prevent exploitation?

No. The vulnerable RRSet canonicalisation occurs before DNSSEC validation, so a malicious response can reach the vulnerable code before DNSSEC checks are performed.

Q: What is the likely impact if exploitation succeeds?

The issue is a heap buffer overflow and is rated high severity with an availability impact of high. The provided vector does not identify confidentiality or integrity impact.

Published Sep 16, 2026

Updated

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.

Affected Software

8 affected componentsFixes available

ubuntu/unbound<1.4.22-1ubuntu4.14.04.3+esm5

1.4.22-1ubuntu4.14.04.3+esm5

ubuntu/unbound<1.5.8-1ubuntu1.1+esm5

1.5.8-1ubuntu1.1+esm5

ubuntu/unbound<1.6.7-1ubuntu2.6+esm6

1.6.7-1ubuntu2.6+esm6

ubuntu/unbound<1.9.4-2ubuntu1.11+esm3

1.9.4-2ubuntu1.11+esm3

ubuntu/unbound<1.13.1-1ubuntu5.17

1.13.1-1ubuntu5.17

ubuntu/unbound<1.19.2-1ubuntu3.12

1.19.2-1ubuntu3.12

ubuntu/unbound<1.25.1-1ubuntu3.1

1.25.1-1ubuntu3.1

ubuntu/unbound<1.24.2-1ubuntu2.4

1.24.2-1ubuntu2.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.4.22-1ubuntu4.14.04.3+esm5
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.5.8-1ubuntu1.1+esm5
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.6.7-1ubuntu2.6+esm6
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.9.4-2ubuntu1.11+esm3
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.13.1-1ubuntu5.17
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.19.2-1ubuntu3.12
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.25.1-1ubuntu3.1
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.24.2-1ubuntu2.4

Event History

Sep 16, 2026

CVE Published

via OSV·09:17 AM

Data Sourced

via OSV·09:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Ubuntu systems running NLnet Labs Unbound up to and including version 1.26.0 are affected. Exploitation requires Unbound to process a crafted DNS response associated with a 255-byte query name and a large TCP response.

What attacker position is required to trigger the overflow?

An attacker can trigger it by operating a malicious authoritative name server or by tampering with a response received by Unbound. No authentication or user interaction is required according to the supplied severity vector.

Does DNSSEC validation prevent exploitation?

No. The vulnerable RRSet canonicalisation occurs before DNSSEC validation, so a malicious response can reach the vulnerable code before DNSSEC checks are performed.

What is the likely impact if exploitation succeeds?

The issue is a heap buffer overflow and is rated high severity with an availability impact of high. The provided vector does not identify confidentiality or integrity impact.

UBUNTU-CVE-2026-81634: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What attacker position is required to trigger the overflow?

Does DNSSEC validation prevent exploitation?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What attacker position is required to trigger the overflow?

Does DNSSEC validation prevent exploitation?

What is the likely impact if exploitation succeeds?