NLnet Labs advisory dated 16 September 2026 assigns CVE-2026-81642 to a Critical heap overflow in Unbound’s DNSSEC validator when digesting a DNSKEY whose owner name is a compression pointer into its own RDATA. An attacker who controls a malicious zone and queries a vulnerable resolver can cause denial of service and possible remote code execution through attacker-controlled data. NLnet Labs rates Critical with maintainer CVSS 9.1 (CVSS:4.0 network/no privileges/no UI).

Affected: Unbound up to and including 1.26.0 (includes 1.25.2 and 1.26.0). Fixed: Unbound 1.26.1 (source + Windows binaries) or apply NLnet Labs patches (minimal or complete for CVE-2026-81642; combined patch covers nine CVEs in the release, including high CVE-2026-82717 CNAME-synthesis heap corruption).

NLnet Labs reports no known exploitation. (source: NLnet Labs CVE-2026-81642.txt)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: NLnet Labs)