A major security update has been issued for Unbound, the widely used validating DNS resolver developed by NLnet Labs. On September 16, 2026, the project disclosed a batch of high-severity vulnerabilities affecting versions up to and including 1.26.0, with fixes released in version 1.26.1. These flaws range from heap buffer overflows and use-after-free bugs to DNSSEC validation bypasses, any of which could allow attackers to crash servers or, in some cases, achieve remote code execution.
RCE and denial-of-service risks
Among the most serious issues is a heap buffer overflow in Unbound’s DNSSEC validator that can be triggered by a malicious DNSKEY record containing a self-referential compression pointer. This bug, credited to researchers from Nankai University, can lead to denial of service and potential remote code execution because the digest buffer overflows when processing such crafted records. Two additional memory-corruption bugs were also reported: one in DNSSEC canonicalization that affects long query names over TCP, and another in CNAME synthesis that can progressively corrupt heap memory and, under specific conditions, allow code execution. All three vulnerabilities are fixed in the 1.26.1 release, and manual patches are available for administrators who cannot immediately upgrade.
Unbound’s support for encrypted DNS transports is also affected. A use-after-free bug in the DNS-over-QUIC (DoQ) implementation can be triggered by a malicious client that sends a RESET_STREAM and withholds ACKs, eventually causing the server to exit abnormally after as few as 20 queries. Similarly, a use-after-free in the DNS-over-HTTPS (DoH) cleanup path can be exploited when RPZ drops queries or under heavy traffic, potentially leading to process termination on hardened allocators. In addition, a degradation-of-service flaw in TCP/DoT handling allows an attacker to monopolize a worker’s event loop by streaming distinct uncached queries over a single connection, with no limit on consecutive reads. Fixes for these issues adjust stream shutdown behavior, correct DoH mesh accounting, and introduce read limits similar to those already used for UDP.
Beyond memory safety, several logic errors undermine Unbound’s security guarantees. A ZONEMD verification bypass creates a window where tampered zone data can be served or written to disk before integrity checks complete, affecting zones below a trust anchor. A cross-zone cache-poisoning bug allows a malicious actor controlling one delegated zone under an NSEC-signed parent to inject insecure wildcard DS records for unrelated sibling domains, effectively forging delegations. Another flaw lets the “serve-expired” feature bypass the wait-limit counter introduced for the DNSBomb mitigation (CVE-2024-33655), enabling pulsing DoS amplification attacks from a single IP. The “ReTrap” family of algorithmic-complexity attacks (TagTrap, DelegationTrap, NsecTrap, AdditionalTrap) can also degrade service by forcing excessive DNSSEC validation work; Unbound 1.26.1 adds throttles and disables validation of the additional section by default to mitigate this.
Role of administrators
All users running Unbound 1.26.0 or earlier are urged to upgrade to version 1.26.1 as soon as possible, especially on internet-facing resolvers or those handling DNSSEC-validated traffic. If immediate upgrade is not feasible, NLnet Labs provides individual patches for each CVE that can be applied manually to the source tree. Operators should also review configurations for features like DNS-over-QUIC, DNS-over-HTTPS, DNSCrypt, response-ip/RPZ, and serve-expired, since several vulnerabilities require these options to be enabled. Given Unbound’s role in the DNS infrastructure of countless networks, prompt patching is critical to prevent outages and exploitation in the wild.
Read the original article: