The CVE number for this vulnerability is CVE-2026-82717.


== Description
A vulnerability was found in Unbound that can progressively corrupt heap memory
and under certain systems and compilation options could lead to remote code
execution.
The vulnerability starts when CNAME synthesis during an upstream response needs
to enforce(rewrite) a max TTL value in the packet buffer.
Coupled with a compression pointer that points to the overwritten value and
invalidates the domain name, it leads to an error path that does not properly
move the buffer position and allows for the heap buffer overflow.

Since this is heavily reliant on heap memory layout, results are memory
corruption that eventually leads to a crash and under specific systems and
compilation options remote code execution.

Unbound 1.26.1 includes fixes to address all the individual issues that
combined result to the vulnerability.


== Affected products
Unbound up to and including version 1.26.0.


== Mitigation

=== Downloading patched version
Unbound 1.26.1 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz

=== Applying the patch manually
For Unbound 1.26.0 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-82717_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-82717_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-82717.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.26.0.


== Acknowledgments
We would like to thank Ben Morris from Anthropic for discovering and
responsibly disclosing the vulnerability.