NLNET Labs released Unbound 1.26.1 on 16 September 2026 to address nine vulnerabilities affecting installations up to and including version 1.26.0. The issues span DNSSEC processing, cache validation and network transport handling, and include one critical, two high, five medium and one low-severity flaw. The highest-rated, CVE-2026-81642, has a CVSS v4 score of 9.1 and could cause denial of service or potentially remote code execution when the DNSSEC validator processes a specially crafted DNSKEY record. The article says no exploitation has been confirmed and no public proof-of-concept code is available.
Other notable flaws include CVE-2026-81634, a possible heap buffer overflow during DNSSEC canonicalisation involving a 255-character query name and a large TCP response, and CVE-2026-82717, which can progressively corrupt heap memory during CNAME synthesis and could lead to remote code execution in certain systems and compilation configurations. The release also fixes use-after-free issues in DoQ and DoH handling, a possible service degradation issue, and the ReTrap algorithmic-complexity attack against DNSSEC.
Administrators are advised to upgrade to Unbound 1.26.1 using the official source release or apply the standalone patches. Where upgrading is not immediately possible, the article recommends disabling unused DoQ and DoH features and restricting resolver access to trusted internal IP ranges. The DoQ issue specifically affects builds using libngtcp2 from version 1.22.0 onwards.