Unbound CVE-2026-81634

Requires the attacker to control an authoritative name server that the victim Unbound resolver will query, OR an on-path position to tamper with an incoming DNS response; the malicious response must be delivered over TCP, be large, and contain an RRSet whose owner name reaches the 255-byte maximum to trigger the length-check gap during canonicalisation. Applies to Unbound up to and including 1.26.0 in default recursive-resolver operation - no authentication or victim user interaction with the resolver itself is needed, though the resolver must be induced to resolve the attacker-influenced name. Limiting factors: DNSSEC does NOT mitigate (canonicalisation precedes validation); the pure response-tampering variant requires a MITM/on-path capability, and crafting the exact 255-byte owner name plus large TCP response raises practical complexity above the AC:L rating.

The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent and, unlike many kernel/network CVEs, does NOT overstate impact: it correctly scopes this to availability-only (C:N/I:N/A:H) despite the CWE-122 heap overflow, because NLnet Labs assesses the realistic outcome as a crash/DoS rather than confirmed code execution. The genuine risk driver is the attack position: exploitation requires the attacker either to operate an authoritative name server the victim resolver queries, or to tamper with an in-flight response, and canonicalisation runs BEFORE DNSSEC validation so signing does not mitigate. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit is referenced - so all three exploitation-likelihood signals are either absent or negative. The one point worth scrutiny is AC:L: reliably triggering requires a 255-length query name paired with a large TCP response, which is craftable by an attacker who controls the malicious nameserver but is meaningfully harder for a pure on-path tamperer, so real-world complexity trends higher than AC:L implies. Net: a legitimate patch-worthy DoS in ubiquitous resolver software, but not an emergency - no evidence of active exploitation or automation, and impact is confined to service disruption of the resolver process.

An attacker registers or controls an authoritative name server and lures a target Unbound resolver into querying a domain under their control (e.g., via a web page, email, or embedded resource that forces a lookup). They return a large TCP DNS response containing an RRSet whose owner name reaches the 255-byte limit, so that during RRSet canonicalisation the missing first-owner-name length accounting overflows the heap buffer and crashes the resolver. No public proof-of-concept is referenced in the available data.