Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
Unbound DNS resolver can be crashed or hacked
published 24 days ago
Summary
The Unbound DNS service used on openeuler systems may stop working or allow unauthorized code to run when it processes specially crafted DNS keys. This happens because the validator can overflow its memory buffer. Update Unbound to a version newer than 1.26.0 to protect your network.
What to do
- Update openeuler unbound to version 1.17.1-21.oe2403sp4.
- Update openeuler unbound to version 1.11.0-27.oe2003sp4.
- Update openeuler unbound to version 1.13.2-27.oe2203sp4.
- Update openeuler unbound to version 1.17.1-21.oe2403sp1.
- Update openeuler unbound to version 1.17.1-21.oe2403sp3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP4 | openeuler | unbound |
< 1.17.1-21.oe2403sp4 Fix: upgrade to 1.17.1-21.oe2403sp4
|
| openEuler:20.03-LTS-SP4 | openeuler | unbound |
< 1.11.0-27.oe2003sp4 Fix: upgrade to 1.11.0-27.oe2003sp4
|
| openEuler:22.03-LTS-SP4 | openeuler | unbound |
< 1.13.2-27.oe2203sp4 Fix: upgrade to 1.13.2-27.oe2203sp4
|
| openEuler:24.03-LTS-SP1 | openeuler | unbound |
< 1.17.1-21.oe2403sp1 Fix: upgrade to 1.17.1-21.oe2403sp1
|
| openEuler:24.03-LTS-SP3 | openeuler | unbound |
< 1.17.1-21.oe2403sp3 Fix: upgrade to 1.17.1-21.oe2403sp3
|
Original advisory text
unbound security update
Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn&apos;t make custom builds or provide specific features to paying customers only.
Security Fix(es):
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.(CVE-2026-81642)
Security Fix(es):
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.(CVE-2026-81642)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-81642 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published25 Sep 2026
Updated30 Sep 2026
First seen30 Sep 2026
Sources
OESA-2026-4130 · OSV
Track software like this
Free during beta