Unbound

Unbound 1.26.1 Patches Critical DNSSEC Validator Flaw CVE-2026-81642 Enabling Remote Code Execution

NLnet Labs has released Unbound 1.26.1 to address CVE-2026-81642, a critical vulnerability in the DNSSEC validator that can cause service crashes and potential remote code execution. The flaw affects all versions up to and including 1.26.0 and is triggered when validating a malicious DNS zone. It resides in the handling of DNSKEY records, where a buffer overflow can occur during DNS response processing. The vulnerability carries a CVSS 4.0 score of 9.1 with a network attack vector, no privileges required, and no user interaction needed. Exploitation requires an attacker to control a malicious DNS zone that the resolver queries, which can lead to denial of service or RCE in the worst case. The update also includes fixes for eight additional security issues, including CVE-2026-82717 and CVE-2026-81634, both involving heap corruption.

DNS Resolver Operator Discovers Missing DNSSEC Validation After Six Months via External Test

A solo developer running VantageDNS, a recursive DNS resolver with filtering, discovered that DNSSEC validation had been disabled for six months after running an external DNS-OARC test. The test flagged "Lookup succeeded while signature was invalid," revealing that the resolver was accepting and returning responses with invalid DNSSEC signatures instead of returning SERVFAIL. Internal monitoring remained green throughout because the absence of validation does not trigger latency spikes, error rates, or availability alerts. The root cause traced back to a comment in the Unbound configuration left from an MVP phase that referenced enabling validation in Sprint 5, which never occurred. After enabling validation using a static trust-anchor-file, the operator documented the correct verification steps using dnssec-failed.org and domains with the AD flag, while noting that performance impact was negligible. The incident highlighted that security properties like DNSSEC validation require active, periodic external probing rather than passive monitoring.