The CVE number for this vulnerability is CVE-2026-81642.


== Description
A vulnerability was found in Unbound's DNSSEC validator that enables denial of
service and possible remote code execution as a result of digesting DNSKEYs.
A DNSKEY with an owner compression pointer to its own RDATA can overflow the
digest buffer.
Remote code execution is possible through attacker controlled data.

An adversary can exploit the vulnerability by controlling a malicious zone and
querying a vulnerable Unbound.

Unbound 1.26.1 includes a fix to properly check the offending buffer's capacity
after decompression and before writing.


== Affected products
Unbound up to and including version 1.26.0.


== Mitigation

=== Downloading patched version
Unbound 1.26.1 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz

=== Applying the patch manually
For Unbound 1.26.0 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-81642_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-81642_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-81642.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.26.0.


== Acknowledgments
We would like to thank Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab
for discovering and responsibly disclosing the vulnerability.