CVE-2026-81634

Katalog CVE

CVSS 7.5 · High EPSS 0,48%

Kerentanan Heap-based Buffer Overflow pada nlnetlabs unbound. Skor CVSS 3.1 7.5 (High) menurut nlnetlabs.nl.

Deskripsi (NVD)

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.

Rincian

Terbit di NVD

16 September 2026

Terakhir diubah

23 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber nlnetlabs.nl
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt patch · advisory vendor