Heap Buffer Overflow in Unbound DNS Resolver from NLnet Labs

CVE-2026-81634

What is CVE-2026-81634?

A heap buffer overflow vulnerability exists in NLnet Labs' Unbound DNS resolver, affecting versions up to and including 1.26.0. This flaw is triggered by a 255-length query name accompanied by a large TCP response, which fails to properly account for the first owner name in buffer length checks during the RRSet canonicalization process. An attacker controlling a malicious DNS server or manipulating response packets can exploit this vulnerability, posing a significant risk as canonicalization occurs prior to DNSSEC validation.

References