If your resolver runs Unbound with DNSSEC validation on, move to 1.26.1. The bug is a critical heap overflow in the validator, and NLnet Labs’ advisory on Wednesday put every build through 1.26.0 in the affected range, 1.25.2 and 1.26.0 included.
Tracked as CVE-2026-81642, it takes two ingredients: a DNS zone the attacker controls, and a vulnerable resolver induced to query it. A denial of service is the stated impact, with code execution possible “through attacker controlled data.” NLnet Labs scores the flaw critical at 9.1, its own figure, since NVD still listed the entry as “Awaiting Analysis” on Wednesday. Nothing in the vector requires privileges or user action.
Among the eight other fixes in that release is CVE-2026-82717, a heap corruption issue in CNAME record synthesis reported by Anthropic’s Ben Morris, capable of code execution “under certain systems and compilation options.”
Why a memory bug here travels
Getting at the DNSSEC overflow means presenting a DNSKEY record whose owner name is a compression pointer aimed back at data inside that same record, while the validator is midway through digesting it. The packet is cheap to send. What it leaves behind is a resolver that has crashed, or one an attacker now controls, and Unbound sits behind a large slice of the internet’s validation.
May’s CVE-2026-33278 was something else entirely, and 1.25.1, the release that closed it, never addressed this one. In unstable, 1.26.1-1 already counts as fixed on Debian’s tracker; the bookworm, trixie and forky branches have not caught up and are still marked vulnerable.
Where an immediate upgrade is not possible, the standalone patches were tested against 1.26.0 and work. One default moves too: val-clean-additional ships switched off, so DNSSEC data in the additional section of a response goes unvalidated until it is turned back on.
