CVE-2026-82717Disclosure(nlnetlabs / unbound)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch nlnetlabs unbound systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.

nlnetlabs CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt

Weakness type (CWE)

CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

unbound

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-09-17); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

nlnetlabs

Products

unbound

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets1 URL

By indicator

https://thehackernews.com/2026/09/critical-unbound-dnssec-validator-flaw.html

Classification over time

Date	Total	Labels

2026-09-17	2	Disclosure2
2026-09-19	1	Patch1

Full discourse3 posts

The Hacker News@TheHackersNews46d
Disclosure
‼️ Critical Unbound DNSSEC validator flaw (CVE-2026-82717) could allow remote code execution. An attacker who controls a malicious zone can trigger the heap overflow by querying a vulnerable resolver. 1.26.0 and earlier are affected. Read details → https://thehackernews.com/2026/09/critical-unbound-dnssec-validator-flaw.html
Post summary
The post discloses a critical Unbound DNSSEC validator flaw, CVE-2026-82717, that could allow remote code execution via a heap overflow triggered by a malicious zone, with versions 1.26.0 and earlier affected. It provides a link to details but does not confirm a PoC, exploit tool, active exploitation, or specific patch.
6443872639.5K
2.4M followersView on X
Cyb3rVolt3x@AndraxPentester44d
Patch
@TheHackersNews THN's article separates them. NLnet Labs tracks the critical DNSKEY validator overflow as CVE-2026-81642, fixed in Unbound 1.26.1. CVE-2026-82717 is the separate CNAME heap bug. This post names only the second. No exploitation reported. The 1.25.1 fix does not cover 81642.
Post summary
The tweet discusses two DNS-related CVEs, mentions a patch for CVE-2026-81642 (Unbound 1.26.1), and explicitly reports no active exploitation for the second CVE.
0000056
45 followersView on X
NeoTeo.com@NeoteoCom46d
Disclosure
CVE-2026-82717 en Unbound permite ejecución remota de código por un heap overflow en el validador DNSSEC. Afecta a la versión 1.26.0 y anteriores. https://thehackernews.com/2026/09/critical-unbound-dnssec-validator-flaw.html
Post summary
The tweet discloses CVE‑2026‑82717, describing a critical heap overflow in Unbound’s DNSSEC validator that enables remote code execution and impacts version 1.26.0 and earlier.
00000152
15.9K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nlnetlabs	unbound	-	-	-

Explore more

Back to dashboard nlnetlabs CVEs unbound vulnerabilities

What researchers are saying

CVE-2026-82717

Cyb3rVolt3x[verified]@AndraxPentesterPatch

The tweet discusses two DNS-related CVEs, mentions a patch for CVE-2026-81642 (Unbound 1.26.1), and explicitly reports no active exploitation for the second CVE.

NeoTeo.com[verified]@NeoteoComDisclosure

The tweet discloses CVE‑2026‑82717, describing a critical heap overflow in Unbound’s DNSSEC validator that enables remote code execution and impacts version 1.26.0 and earlier.

The Hacker News@TheHackersNewsDisclosure

The post discloses a critical Unbound DNSSEC validator flaw, CVE-2026-82717, that could allow remote code execution via a heap overflow triggered by a malicious zone, with versions 1.26.0 and earlier affected. It provides a link to details but does not confirm a PoC, exploit tool, active exploitation, or specific patch.