Nlnet Labs

CVE	Summary	Severity	CVSS	EPSS	Priority
CVE-2026-81642	A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC validator of NLnet Labs Unbound 1.26.0 and earlier, letting an attacker who controls an authoritative zone crash a validating recursive resolver and, depending on heap layout, potentially execute code with attacker-influenced data. Exploitation is unauthenticated over the network per the CVSS vectors but is gated on DNSSEC validation being active and on inducing the resolver to query a name in the attacker's zone; the independently assessed impact is primarily denial of service (availability High, confidentiality and integrity Low), with remote code execution only possible rather than demonstrated. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although the vendor rates the issue 9.1 under CVSS 4.0 and an advisory has been published.	CRITICAL	9.1	0.5%	46
CVE-2026-82717	Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker who controls or spoofs the upstream DNS response (PR:N/UI:N) gradually overwrite heap memory, with the reliable outcome being a crash and remote code execution possible only on certain systems and compilation options that lack hardening. The flaw is scored CVSS 8.4 (CVSS:4.0) and by the independent assessment as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with the high attack complexity reflecting heavy dependence on heap layout and non-deterministic results. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no KEV listing or EPSS signal is present, so this is a genuine but not-yet-urgent priority for internet-facing recursive resolvers.	HIGH	8.4	0.4%	42
CVE-2026-19538	NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a kept-open TCP or TLS connection, allowing a remote unauthenticated attacker to bypass ACL denials that should have blocked the request. NLnet Labs reported this against all NSD versions (CPE wildcard scope), classifying it under CWE-290 as an authentication bypass by spoofing. No public exploit code has been identified at time of analysis, but the bypass mechanic - sending a query twice on the same persistent connection - is mechanically trivial once the proxy protocol port is reachable.	HIGH	8.2	0.4%	41
CVE-2026-19401	NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DNS Cookie options with a UDP payload size of 512 bytes, triggering a reachable assertion (CWE-617). This condition exists exclusively in debugging and non-release build types - standard production release builds are immune. Remote unauthenticated attackers can continuously respawn-crash serve children to severely degrade or fully deny DNS resolution service; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.	HIGH	8.2	0.3%	41
CVE-2026-18664	IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatch in the range comparison logic. Both IPv4 and IPv6 addresses are compared as unsigned 32-bit integers using host byte order, while the actual stored values are in network byte order (big-endian), causing comparisons to produce incorrect results on the dominant x86/x86-64/ARM-LE server platforms. The practical consequence is a bidirectional access control bypass: operators relying on hyphen-range ACL syntax may inadvertently permit unauthorized IP addresses to access restricted DNS operations (such as zone transfers) while simultaneously denying legitimate clients. No public exploit has been identified at time of analysis, but the flaw is fully deterministic and requires no special attacker capability beyond network reachability.	HIGH	8.2	0.3%	41
CVE-2026-81634	Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-framed DNS response encounters an RRSet whose owner name reaches the 255-byte maximum, crashing the resolver process and yielding a denial of service (availability-only impact, C:N/I:N/A:H). An attacker must either operate an authoritative name server that the victim resolver queries or hold an on-path position to tamper with an incoming DNS response, and the malicious answer must be delivered over TCP, be large, and carry the maximal-length owner name; crafting and delivering that payload raises practical complexity above the vendor's AC:L rating, which is why our assessment uses AC:H. No public exploit code or confirmed active exploitation has been identified at time of analysis, and because canonicalisation runs before DNSSEC validation, signature validation does not mitigate the issue. NLnet Labs has published an advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt.	HIGH	7.5	0.4%	38
CVE-2026-18916	TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child processes by deliberately shrinking the TCP receive window to near-zero after issuing a DNS query over TCP, triggering an integer underflow (CWE-191). By repeating this pattern continuously, the attacker can deny all TCP-based DNS service from the affected NSD instance. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects moderate availability impact with zero confidentiality or integrity exposure.	MEDIUM	6.9	0.3%	35
CVE-2026-78227	Unbound versions 1.22.0 through 1.26.1 built with DNS-over-QUIC support (--with-libngtcp2) can be driven to an abnormal exit by an unauthenticated remote attacker who manipulates QUIC stream state. The attacker sends a DoQ query, withholds ACKs, issues RESET_STREAM to free the per-stream output buffer, then waits for a PTO timeout so ngtcp2 re-encodes a STREAM frame from the freed memory; a spray of roughly 20 such queries forces the daemon down. Default builds compiled without QUIC support are not affected, and exploitation also requires precise timing against the QUIC state machine, making this a moderate, configuration-gated availability threat rather than a top-tier priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the authoritative assessment rates it AV:N/AC:H/PR:N/UI:N/S:U with low confidentiality and high availability impact, so the practical outcome is denial of service against the resolver rather than broad data compromise.	MEDIUM	6.5	0.3%	33
CVE-2026-82720	Denial of service in NLnet Labs Unbound 1.12.0 through 1.26.0 arises from a use-after-free in the DNS-over-HTTPS (DoH) code path, reachable only in builds compiled with --with-libnghttp2 when failure conditions such as an RPZ drop action or heavy-traffic stream jostling occur. A remote, unauthenticated attacker can trigger the flaw with a single DoH connection and appropriate traffic, causing memory corruption that, under a hardened allocator, results in controlled termination of the Unbound process. No public exploit code has been identified at time of analysis; the impact is confined to availability (CVSS 5.9, C:N/I:N/A:H) with no confidentiality or integrity effect.	MEDIUM	5.9	0.3%	30
CVE-2026-80225	Sustained high-rate streams of distinct uncached names over TCP or DNS-over-TLS can monopolize a single NLnet Labs Unbound worker's event loop, degrading resolver availability for other clients in Unbound versions up to and including 1.26.0. The issue is remotely reachable and unauthenticated (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), but the attacker must hold a connection and keep write throughput ahead of the server's drain/processing so the unbounded consecutive-read loop never yields; impact is confined to the affected worker, is degradation rather than a crash, and ends once the traffic stops, while connection caps, query-rate limits, and upstream rate-limiting reduce feasibility. No public exploit identified at time of analysis, and no evidence of confirmed actively exploited (CISA KEV) status; the vendor's CVSS of 5.3 is consistent with this modest degradation-of-service profile.	MEDIUM	5.3	0.3%	27
CVE-2026-85501	Algorithmic complexity attacks against DNSSEC validation in NLnet Labs Unbound 1.26.0 and earlier let remote unauthenticated attackers degrade resolver performance by steering queries to malicious zones that amplify validation work - TagTrap (floods of mismatched DNSKEY/RRSIG/DS records), DelegationTrap (deeply nested chain-of-trust validation), NsecTrap (excessive invalid NSEC records), and AdditionalTrap (Unbound's default DNSSEC validation of the ADDITIONAL section). Exploitation requires a DNSSEC-validating Unbound resolver and attacker control of the zone being resolved, and impact is limited to resource exhaustion (CVSS 5.3, availability Low) rather than compromise or a guaranteed crash. No public exploit identified at time of analysis, and the attacker must be able to drive query volume through the resolver for meaningful effect.	MEDIUM	5.3	0.3%	27
CVE-2026-77955	Unbound 1.13.2 through 1.26.1 can serve tampered contents of a ZONEMD-checked zone that sits below - but not at - a DNSSEC trust anchor, because the DS/DNSKEY chain resolution needed to validate the zone must complete asynchronously and the zone data is released (and, with the zonefile: option, written to disk) before the ZONEMD digest check concludes. In memory the exposure is self-correcting: once verification fails the data stops being served, but a tampered copy written to disk persists and is reloaded at the next startup until verification again concludes. Per the independent assessment this is a low-to-moderate integrity/authenticity issue (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N; vendor score 4.4) requiring a non-default zone/trust-anchor topology and precise timing, with no confidentiality or availability impact and no public exploit identified at time of analysis.	MEDIUM	4.4	0.1%	22
CVE-2026-77860	NLnet Labs Unbound 1.20.0 through 1.26.0 can be made to accumulate an unbounded number of pending recursive queries from a single source IP because a double decrement on the per-client 'wait-limit' counter occurs on the 'serve-expired' code path. A remote, unauthenticated attacker who controls an authoritative zone with short TTLs alternates a deliberately unanswered 'slow' query with a 'pump' query for an expired cached name, keeping the counter at or below the configured limit and eventually filling a thread's global mesh quota (num-queries-per-thread), thereby bypassing one of the countermeasures introduced for DNSBomb (CVE-2024-33655). Impact is availability-only and limited (CVSS 3.7, AC:H, A:L) and depends on the non-default 'serve-expired' feature; no public exploit has been identified at time of analysis.	LOW	3.7	0.3%	19

CVE-2026-81642

A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC validator of NLnet Labs Unbound 1.26.0 and earlier, letting an attacker who controls an authoritative zone crash a validating recursive resolver and, depending on heap layout, potentially execute code with attacker-influenced data. Exploitation is unauthenticated over the network per the CVSS vectors but is gated on DNSSEC validation being active and on inducing the resolver to query a name in the attacker's zone; the independently assessed impact is primarily denial of service (availability High, confidentiality and integrity Low), with remote code execution only possible rather than demonstrated. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although the vendor rates the issue 9.1 under CVSS 4.0 and an advisory has been published.

CRITICAL

9.1

0.5%

46

CVE-2026-82717

Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker who controls or spoofs the upstream DNS response (PR:N/UI:N) gradually overwrite heap memory, with the reliable outcome being a crash and remote code execution possible only on certain systems and compilation options that lack hardening. The flaw is scored CVSS 8.4 (CVSS:4.0) and by the independent assessment as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with the high attack complexity reflecting heavy dependence on heap layout and non-deterministic results. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no KEV listing or EPSS signal is present, so this is a genuine but not-yet-urgent priority for internet-facing recursive resolvers.

HIGH

8.4

0.4%

42

CVE-2026-19538

NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a kept-open TCP or TLS connection, allowing a remote unauthenticated attacker to bypass ACL denials that should have blocked the request. NLnet Labs reported this against all NSD versions (CPE wildcard scope), classifying it under CWE-290 as an authentication bypass by spoofing. No public exploit code has been identified at time of analysis, but the bypass mechanic - sending a query twice on the same persistent connection - is mechanically trivial once the proxy protocol port is reachable.

HIGH

8.2

0.4%

41

CVE-2026-19401

NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DNS Cookie options with a UDP payload size of 512 bytes, triggering a reachable assertion (CWE-617). This condition exists exclusively in debugging and non-release build types - standard production release builds are immune. Remote unauthenticated attackers can continuously respawn-crash serve children to severely degrade or fully deny DNS resolution service; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

HIGH

8.2

0.3%

41

CVE-2026-18664

IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatch in the range comparison logic. Both IPv4 and IPv6 addresses are compared as unsigned 32-bit integers using host byte order, while the actual stored values are in network byte order (big-endian), causing comparisons to produce incorrect results on the dominant x86/x86-64/ARM-LE server platforms. The practical consequence is a bidirectional access control bypass: operators relying on hyphen-range ACL syntax may inadvertently permit unauthorized IP addresses to access restricted DNS operations (such as zone transfers) while simultaneously denying legitimate clients. No public exploit has been identified at time of analysis, but the flaw is fully deterministic and requires no special attacker capability beyond network reachability.

HIGH

8.2

0.3%

41

CVE-2026-81634

Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-framed DNS response encounters an RRSet whose owner name reaches the 255-byte maximum, crashing the resolver process and yielding a denial of service (availability-only impact, C:N/I:N/A:H). An attacker must either operate an authoritative name server that the victim resolver queries or hold an on-path position to tamper with an incoming DNS response, and the malicious answer must be delivered over TCP, be large, and carry the maximal-length owner name; crafting and delivering that payload raises practical complexity above the vendor's AC:L rating, which is why our assessment uses AC:H. No public exploit code or confirmed active exploitation has been identified at time of analysis, and because canonicalisation runs before DNSSEC validation, signature validation does not mitigate the issue. NLnet Labs has published an advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt.

HIGH

7.5

0.4%

38

CVE-2026-18916

TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child processes by deliberately shrinking the TCP receive window to near-zero after issuing a DNS query over TCP, triggering an integer underflow (CWE-191). By repeating this pattern continuously, the attacker can deny all TCP-based DNS service from the affected NSD instance. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects moderate availability impact with zero confidentiality or integrity exposure.

MEDIUM

6.9

0.3%

35

CVE-2026-78227

Unbound versions 1.22.0 through 1.26.1 built with DNS-over-QUIC support (--with-libngtcp2) can be driven to an abnormal exit by an unauthenticated remote attacker who manipulates QUIC stream state. The attacker sends a DoQ query, withholds ACKs, issues RESET_STREAM to free the per-stream output buffer, then waits for a PTO timeout so ngtcp2 re-encodes a STREAM frame from the freed memory; a spray of roughly 20 such queries forces the daemon down. Default builds compiled without QUIC support are not affected, and exploitation also requires precise timing against the QUIC state machine, making this a moderate, configuration-gated availability threat rather than a top-tier priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the authoritative assessment rates it AV:N/AC:H/PR:N/UI:N/S:U with low confidentiality and high availability impact, so the practical outcome is denial of service against the resolver rather than broad data compromise.

MEDIUM

6.5

0.3%

33

CVE-2026-82720

Denial of service in NLnet Labs Unbound 1.12.0 through 1.26.0 arises from a use-after-free in the DNS-over-HTTPS (DoH) code path, reachable only in builds compiled with --with-libnghttp2 when failure conditions such as an RPZ drop action or heavy-traffic stream jostling occur. A remote, unauthenticated attacker can trigger the flaw with a single DoH connection and appropriate traffic, causing memory corruption that, under a hardened allocator, results in controlled termination of the Unbound process. No public exploit code has been identified at time of analysis; the impact is confined to availability (CVSS 5.9, C:N/I:N/A:H) with no confidentiality or integrity effect.

MEDIUM

5.9

0.3%

30

CVE-2026-80225

Sustained high-rate streams of distinct uncached names over TCP or DNS-over-TLS can monopolize a single NLnet Labs Unbound worker's event loop, degrading resolver availability for other clients in Unbound versions up to and including 1.26.0. The issue is remotely reachable and unauthenticated (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), but the attacker must hold a connection and keep write throughput ahead of the server's drain/processing so the unbounded consecutive-read loop never yields; impact is confined to the affected worker, is degradation rather than a crash, and ends once the traffic stops, while connection caps, query-rate limits, and upstream rate-limiting reduce feasibility. No public exploit identified at time of analysis, and no evidence of confirmed actively exploited (CISA KEV) status; the vendor's CVSS of 5.3 is consistent with this modest degradation-of-service profile.

MEDIUM

5.3

0.3%

27

CVE-2026-85501

Algorithmic complexity attacks against DNSSEC validation in NLnet Labs Unbound 1.26.0 and earlier let remote unauthenticated attackers degrade resolver performance by steering queries to malicious zones that amplify validation work - TagTrap (floods of mismatched DNSKEY/RRSIG/DS records), DelegationTrap (deeply nested chain-of-trust validation), NsecTrap (excessive invalid NSEC records), and AdditionalTrap (Unbound's default DNSSEC validation of the ADDITIONAL section). Exploitation requires a DNSSEC-validating Unbound resolver and attacker control of the zone being resolved, and impact is limited to resource exhaustion (CVSS 5.3, availability Low) rather than compromise or a guaranteed crash. No public exploit identified at time of analysis, and the attacker must be able to drive query volume through the resolver for meaningful effect.

MEDIUM

5.3

0.3%

27

CVE-2026-77955

Unbound 1.13.2 through 1.26.1 can serve tampered contents of a ZONEMD-checked zone that sits below - but not at - a DNSSEC trust anchor, because the DS/DNSKEY chain resolution needed to validate the zone must complete asynchronously and the zone data is released (and, with the zonefile: option, written to disk) before the ZONEMD digest check concludes. In memory the exposure is self-correcting: once verification fails the data stops being served, but a tampered copy written to disk persists and is reloaded at the next startup until verification again concludes. Per the independent assessment this is a low-to-moderate integrity/authenticity issue (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N; vendor score 4.4) requiring a non-default zone/trust-anchor topology and precise timing, with no confidentiality or availability impact and no public exploit identified at time of analysis.

MEDIUM

4.4

0.1%

22

CVE-2026-77860

NLnet Labs Unbound 1.20.0 through 1.26.0 can be made to accumulate an unbounded number of pending recursive queries from a single source IP because a double decrement on the per-client 'wait-limit' counter occurs on the 'serve-expired' code path. A remote, unauthenticated attacker who controls an authoritative zone with short TTLs alternates a deliberately unanswered 'slow' query with a 'pump' query for an expired cached name, keeping the counter at or below the configured limit and eventually filling a thread's global mesh quota (num-queries-per-thread), thereby bypassing one of the countermeasures introduced for DNSBomb (CVE-2024-33655). Impact is availability-only and limited (CVSS 3.7, AC:H, A:L) and depends on the non-default 'serve-expired' feature; no public exploit has been identified at time of analysis.

LOW

3.7

0.3%

19

Severity Breakdown

Monthly CVE Trend

Affected Products (4)

Top Risky CVEs