Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-17 12:30 UTC
Importiert: 2026-09-23 11:49 UTC
CVSS: 9.1
Quelle-ID: thn_global
uid_hash: 1801833251122396c2f069701c4fad81fe0d2ddbad2707da9d2892db3b6fad15

The Hacker News

Inhalt

Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday.

An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution.

Unbound 1.26.1, released the same day, fixes the bug, tracked as CVE-2026-81642, along with

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-81642	CRITICAL	9.1	CRITICAL	9.1			2026-09-16

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste