Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

AI Summary

NLnet Labs disclosed CVE-2026-81642, a critical heap overflow in the DNSSEC validator of all Unbound DNS resolver releases prior to version 1.26.1, exploitable by an attacker controlling a malicious DNS zone to achieve remote code execution on vulnerable resolvers. Unbound 1.26.1 was released simultaneously with the advisory; administrators running Unbound in production should upgrade immediately given the RCE impact on core DNS infrastructure.

Read full article → https://thehackernews.com/2026/09/critical-unbound…

Relevance score: 83.0/100

# More from September 19

1
Cisco warns of max severity ISE zero-day exploited in attacks BleepingComputer
2
Brevo Supply Chain Attack Injects Malware Into 100,000 Websites SecurityWeek
3
Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation The Hacker News
5
Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents The Hacker News
6
An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It. The Hacker News
7
Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root The Hacker News
8
International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data CyberScoop
9
Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2 The Hacker News
10
New Check Point flaw lets hackers execute code with root privileges BleepingComputer