As cited
Copy frozen at (site build).
vulnerabilities
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Unbound DNS resolver versions before 1.26.1 contain a critical heap overflow in the DNSSEC validator that can be triggered by an attacker controlling a malicious DNS zone. The flaw, tracked as CVE-2026-81642, allows remote code execution against vulnerable resolvers. NLnet Labs released version 1.26.1 on September 17, 2026 to fix the vulnerability.
Why it matters: Organizations running Unbound DNS resolvers must upgrade to 1.26.1 immediately to prevent remote code execution attacks against their infrastructure.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Unbound DNS resolver versions before 1.26.1 contain a critical heap overflow in the DNSSEC validator that can be triggered by a malicious DNS zone query, allowing remote code execution. NLnet Labs released the patched version on September 17, 2026 to address the vulnerability tracked as CVE-2026-81642 with a CVSS score of 9.1.
Why it matters: Organizations running Unbound DNS resolvers should immediately upgrade to version 1.26.1 or later, as attackers controlling a malicious DNS zone can achieve remote code execution against unpatched systems.
- Source published
- First seen by Cybersecurity Tracker