CVE-2026-82717: NLnet Labs Unbound RCE Vulnerability

CVE-2026-82717 Overview

NLnet Labs Unbound versions up to and including 1.26.0 contain a heap buffer overflow vulnerability [CWE-122] in the CNAME synthesis code path. The flaw progressively corrupts heap memory when Unbound processes crafted upstream DNS responses. Under specific systems and compilation options, attackers can leverage the corruption to achieve remote code execution. Otherwise, exploitation results in memory corruption that leads to a crash, causing a denial of service condition on the affected resolver. Unbound is a widely deployed open-source recursive DNS resolver, making network-facing installations reachable by any upstream response the resolver queries.

Critical Impact
Attackers who can influence upstream DNS responses can corrupt Unbound's heap memory, causing crashes and, under specific build configurations, remote code execution.

Affected Products

NLnet Labs Unbound versions up to and including 1.26.0
Recursive DNS resolvers built with vulnerable Unbound versions
Systems performing CNAME resolution against untrusted upstream authoritative servers

Discovery Timeline

2026-09-16 - CVE-2026-82717 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82717

Vulnerability Analysis

The vulnerability resides in Unbound's handling of CNAME synthesis during upstream response processing. When Unbound rewrites a CNAME record to enforce a maximum Time-To-Live (TTL) value, it modifies bytes directly in the packet buffer. A crafted response combines this TTL rewrite with a DNS name compression pointer that references the overwritten value. The resulting domain name becomes invalid, triggering an error path in the packet parser.

The error path fails to correctly advance the buffer position before continuing processing. Subsequent read and write operations occur at an incorrect offset, producing a heap buffer overflow classified as [CWE-122]. Because the corruption is progressive and depends on heap layout, exploitation outcomes vary. Most systems experience memory corruption leading to a crash. On systems with specific memory allocators or compilation options, attackers can shape the heap to gain control of execution flow.

Root Cause

The root cause is improper buffer position tracking in the error-handling path invoked when CNAME synthesis produces an invalid compressed domain name. The parser assumes the buffer state is consistent after the TTL rewrite but does not validate this before continuing.

Attack Vector

An attacker controls an authoritative DNS server or intercepts upstream responses to a target Unbound resolver. The attacker returns a crafted response containing a CNAME record with a TTL value that triggers rewriting and a compression pointer that references the rewritten bytes. The attack requires network access to Unbound's upstream query path but no authentication or user interaction. High attack complexity reflects the reliance on heap layout for successful code execution.

No verified public exploit code is available. For technical details, see the NLnet Labs CVE-2026-82717 Advisory.

Detection Methods for CVE-2026-82717

Indicators of Compromise

Unexpected unbound process crashes or restarts, particularly with SIGSEGV or SIGABRT signals in system logs
Core dumps from unbound referencing heap corruption or invalid memory access in DNS packet parsing routines
Sudden gaps in DNS resolution logs corresponding to resolver process termination
Anomalous upstream DNS responses containing unusual CNAME chains with compression pointers pointing into TTL fields

Detection Strategies

Monitor Unbound process stability metrics and alert on repeated crash-restart cycles within short time windows
Deploy DNS response inspection at the network edge to flag malformed responses with atypical compression pointer offsets
Correlate resolver crashes with source IP addresses of the last queried authoritative servers

Monitoring Recommendations

Enable verbose Unbound logging with verbosity: 2 or higher and forward logs to a centralized analytics platform
Track DNS query error rates and CNAME chain depth statistics for baseline deviation
Monitor host-level indicators including memory allocator errors and unexpected child process termination for the unbound service

How to Mitigate CVE-2026-82717

Immediate Actions Required

Upgrade NLnet Labs Unbound to a version released after 1.26.0 that contains the fix for CVE-2026-82717
Inventory all recursive resolvers in the environment and confirm running versions against the vendor advisory
Restrict Unbound's upstream forwarders to trusted resolvers where feasible to reduce exposure to malicious authoritative responses

Patch Information

NLnet Labs has published details for CVE-2026-82717 in the official advisory. Apply the fixed release referenced in the NLnet Labs CVE-2026-82717 Advisory as soon as change control permits. Rebuild any downstream distributions or container images that bundle Unbound and redeploy affected resolvers.

Workarounds

Route recursive queries through trusted upstream resolvers using forward-zone configuration until patching is complete
Enable DNSSEC validation to reject responses from authoritative servers that fail cryptographic verification
Restrict which clients can query the resolver using access-control directives to limit lateral abuse if the resolver crashes
Consider compiling Unbound with hardened memory allocators and stack protection flags on platforms where the fixed release is not yet available

bash

# Configuration example: restrict upstream and enforce DNSSEC in unbound.conf
server:
    access-control: 10.0.0.0/8 allow
    access-control: 0.0.0.0/0 deny
    harden-dnssec-stripped: yes
    val-permissive-mode: no

forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 1.1.1.1@853#cloudflare-dns.com
    forward-addr: 9.9.9.9@853#dns.quad9.net