EUVD-2026-80290
GHSA-x9ff-rj4v-x6mq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable and unauthenticated (AV:N/PR:N), but reliably crafting a 255-byte owner name with a large TCP response and getting it delivered warrants AC:H; heap overflow yields crash only, so C:N/I:N/A:H.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
3DescriptionCVE.org
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.
AnalysisAI
Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-framed DNS response encounters an RRSet whose owner name reaches the 255-byte maximum, crashing the resolver process and yielding a denial of service (availability-only impact, C:N/I:N/A:H). An attacker must either operate an authoritative name server that the victim resolver queries or hold an on-path position to tamper with an incoming DNS response, and the malicious answer must be delivered over TCP, be large, and carry the maximal-length owner name; crafting and delivering that payload raises practical complexity above the vendor's AC:L rating, which is why our assessment uses AC:H. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to control an authoritative name server that the victim Unbound resolver will query, OR an on-path position to tamper with an incoming DNS response; the malicious response must be delivered over TCP, be large, and contain an RRSet whose owner name reaches the 255-byte maximum to trigger the length-check gap during canonicalisation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent and, unlike many kernel/network CVEs, does NOT overstate impact: it correctly scopes this to availability-only (C:N/I:N/A:H) despite the CWE-122 heap overflow, because NLnet Labs assesses the realistic outcome as a crash/DoS rather than confirmed code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary fix: upgrade to the patched Unbound release identified in the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt; the exact fixed version number is not confirmed in the data available here, so verify it directly against that advisory and the project's release notes rather than assuming a specific tag, and re-check the version string after upgrading (older distro-pinned packages may need a backport request to the distribution). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Unbound deployment and confirm whether any instance runs version 1.26.0 or earlier, prioritizing internet-facing resolvers and those that forward to external authoritative servers; record exact versions and owners. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC
Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker wh
Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone
Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today