The CVE number for this vulnerability is CVE-2026-81634.


== Description
A 255 length query name with a large TCP response can lead to a heap buffer
overflow during the RRSet canonicalisation routine.
This is caused by missing to add the first owner name into the buffer length
check.

A malicious actor operating a malicious name server or tampering with
an incoming response to Unbound (canonicalisation happens before DNSSEC
validation), can trigger the vulnerability.

Unbound 1.26.1 includes a fix to add the first owner name into the
canonicalisation length check and check for the buffer length used before it
is written.


== Affected products
Unbound up to and including version 1.26.0.


== Mitigation

=== Downloading patched version
Unbound 1.26.1 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz

=== Applying the patch manually
For Unbound 1.26.0 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-81634_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-81634_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-81634.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.26.0.


== Acknowledgments
We would like to thank Vlatko Kosturjak with Marlink Cyber for discovering and
responsibly disclosing the vulnerability.