CVE-2026-81634: Unbound DNS Buffer Overflow Vulnerability

CVE-2026-81634 Overview

CVE-2026-81634 is a heap buffer overflow [CWE-122] in NLnet Labs Unbound versions up to and including 1.26.0. The flaw resides in the RRSet canonicalisation routine, which fails to account for the first owner name when performing a buffer length check. A crafted DNS response with a 255-byte query name and a large TCP payload can overrun the heap buffer. Because canonicalisation runs before DNSSEC validation, an attacker controlling an authoritative name server or tampering with in-flight responses can trigger the condition without authentication.

Critical Impact
Remote attackers can crash Unbound resolvers over the network, causing denial of service for all downstream DNS clients relying on the affected recursive resolver.

Affected Products

NLnet Labs Unbound versions up to and including 1.26.0
Recursive DNS resolvers built on affected Unbound releases
Deployments performing DNSSEC validation on TCP responses

Discovery Timeline

2026-09-16 - CVE-2026-81634 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81634

Vulnerability Analysis

Unbound's RRSet canonicalisation routine normalises DNS resource record sets into a byte representation used for DNSSEC signature verification. The routine copies owner names and record data into a working buffer sized against an initial length calculation. That calculation omits the first owner name, producing a buffer smaller than the data ultimately written. When a resolver processes a large TCP response containing a query name at the maximum 255-byte length, the write exceeds the allocated heap region.

The overflow occurs on the resolver side, before DNSSEC validation gates the response. An attacker does not need valid signatures or delegation authority for the target zone. Any upstream that can serve or tamper with a response reaches the vulnerable code path. Corrupted heap metadata typically results in process termination and loss of DNS resolution for served clients.

Root Cause

The defect is a missing accumulator in the buffer sizing logic. The canonicalisation function computes the required buffer using the RRSet's record data and subsequent owner names but never adds the first owner name's length. On maximum-length names combined with a large record set delivered over TCP, the shortfall exceeds the safety margin and the subsequent copy writes past the heap allocation.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction. Two paths exist: operating a malicious authoritative name server that returns a crafted response to a resolver query, or tampering with an in-flight response between an upstream server and Unbound. TCP is required because the malicious payload exceeds typical UDP response sizes. The condition triggers during canonicalisation, ahead of DNSSEC validation, so signed and unsigned zones are equally reachable.

See the NLnet Labs advisory for CVE-2026-81634 for the vendor's technical description.

Detection Methods for CVE-2026-81634

Indicators of Compromise

Unexpected unbound process crashes or restarts correlated with inbound TCP DNS responses
Core dumps referencing the RRSet canonicalisation code path
Loss of recursive DNS availability affecting downstream clients without a corresponding configuration change
Repeated large TCP DNS responses from unfamiliar authoritative servers preceding a crash

Detection Strategies

Monitor Unbound service supervisor logs (systemd, runit, or equivalent) for abnormal termination and restart loops
Inspect DNS traffic for TCP responses containing owner names at or near the 255-byte maximum
Correlate resolver process exits with the source IP of the last TCP response received
Alert when resolver query failure rates spike alongside resolver restarts

Monitoring Recommendations

Enable Unbound extended statistics and export uptime and query-error counters to a metrics pipeline
Forward resolver host telemetry and process-crash events to a central log store for correlation
Baseline normal TCP response volume per upstream to surface anomalous authoritative behaviour
Track DNSSEC validation failure counts, since crashes may occur before validation completes

How to Mitigate CVE-2026-81634

Immediate Actions Required

Upgrade Unbound to a release above 1.26.0 that includes the vendor fix
Restart resolvers after patching to clear any long-lived attacker-influenced state
Restrict outbound resolver traffic to trusted upstream authoritative servers where feasible
Verify high-availability resolver pairs to prevent single-node crashes from causing outages

Patch Information

NLnet Labs has published details for CVE-2026-81634 at the official advisory. Administrators should apply the vendor-supplied release that addresses the buffer length calculation in the RRSet canonicalisation routine. Distribution-packaged Unbound builds should be updated through the OS vendor once backported fixes are available.

Workarounds

Deploy redundant resolvers behind a load balancer so a crash on one node does not sever resolution
Limit resolver exposure to internal clients only and block direct client-to-resolver traffic from untrusted networks
Configure resolver supervisors to auto-restart unbound on abnormal exit as a temporary availability control
Where DNSSEC validation is not required, evaluate whether upstream forwarders performing validation can absorb risk in place of edge resolvers

bash

# Verify installed Unbound version and confirm it exceeds 1.26.0
unbound -V | head -n 1

# Example systemd override to auto-restart on failure as a stopgap
# /etc/systemd/system/unbound.service.d/override.conf
# [Service]
# Restart=always
# RestartSec=2s
sudo systemctl daemon-reload && sudo systemctl restart unbound