A Critical Flaw in Unbound Lets Attackers Hijack DNS Servers

Key points

• A critical bug in Unbound, one of the most widely deployed open-source DNS resolvers, lets an attacker run their own code on the server by answering a single DNS query with a booby-trapped record.
• The flaw, CVE-2026-81642, is rated critical and was disclosed in an advisory from NLnet Labs.
• Every Unbound release before 1.26.1 is affected; version 1.26.1 fixes it.
• Debian's security team lists the resolver as vulnerable in bookworm and trixie, alongside other Unbound bugs disclosed the same day.
• The attack works by luring a resolver into querying a DNS zone the attacker controls, so any server that talks to the open internet is in range.

A single DNS query is now enough to hand control of some internet infrastructure servers to a stranger.

NLnet Labs, the Dutch non-profit that maintains Unbound, has patched a critical heap overflow in the software's DNSSEC validator. DNS is the system that turns names like example.com into the numeric addresses computers use. DNSSEC is the layer that checks those answers haven't been forged. The validator is the part of Unbound that does that checking, and it's also the part an attacker can break.

The bug is filed as CVE-2026-81642. According to the CVE record, a specially crafted DNSKEY record, the cryptographic key DNSSEC uses to prove an answer is genuine, can be built with a pointer that loops back to its own data. When Unbound tries to digest it, the buffer holding the result overflows. Because the overflowing data comes from the attacker, that overflow can be steered into running attacker code on the server.

How would an attacker actually pull this off?

They'd set up their own DNS zone, the chunk of the domain name system they control, and wait for a vulnerable Unbound resolver to query it. Getting a resolver to ask is trivial: a link in an email or an image loaded from a webpage, any lookup pointed at a name inside the malicious zone, will do. The poisoned reply does the rest.

That matters because Unbound sits inside internet service providers, hosting companies and enterprise networks. A compromised resolver isn't just one broken server. It's the machine every other device on the network trusts to tell it where to go. We first covered the DNS threat landscape on 30 July 2026, when researchers warned that dangling DNS records could be weaponised at nation-state scale.

What should administrators do right now?

Upgrade to Unbound 1.26.1. It was released the same day as the advisory, first reported by The Hacker News, and fixes CVE-2026-81642 along with a batch of other issues disclosed together.

That batch deserves attention. Debian's security tracker lists multiple Unbound CVEs published together, covering use-after-free bugs, algorithmic complexity attacks against DNSSEC, and a query-name handling flaw. All are marked vulnerable in current Debian branches, with fixes queued.

Does this affect ordinary internet users?

Not directly, and not yet. There's no sign in the advisory or the CVE record that this bug has been exploited in the wild. The risk sits with operators of DNS servers, not the people using them. If your internet provider or employer runs Unbound and drags its feet on patching, the eventual fallout, redirected websites and stolen logins, could reach you. That's a reason to ask, not to panic.

The uncomfortable part of this disclosure is the shape of it. Several bugs in one resolver, released together, one of them a clean path to code execution. That's the kind of haul that tends to follow a focused audit, and audits like that rarely happen only once.