OESA-2026-4148 (CVE-2026-80225)
Vulnerability from osv_openeuler – Published: 2026-09-30 13:47 – Updated: 2026-09-30 13:47 – Source websiteUnbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.
Security Fix(es):
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.(CVE-2026-80225)
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.(CVE-2026-81634)
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.(CVE-2026-82717)
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"python3-unbound-1.17.1-22.oe2403sp1.aarch64.rpm",
"unbound-1.17.1-22.oe2403sp1.aarch64.rpm",
"unbound-anchor-1.17.1-22.oe2403sp1.aarch64.rpm",
"unbound-debuginfo-1.17.1-22.oe2403sp1.aarch64.rpm",
"unbound-debugsource-1.17.1-22.oe2403sp1.aarch64.rpm",
"unbound-devel-1.17.1-22.oe2403sp1.aarch64.rpm",
"unbound-help-1.17.1-22.oe2403sp1.aarch64.rpm",
"unbound-libs-1.17.1-22.oe2403sp1.aarch64.rpm",
"unbound-utils-1.17.1-22.oe2403sp1.aarch64.rpm"
],
"src": [
"unbound-1.17.1-22.oe2403sp1.src.rpm"
],
"x86_64": [
"python3-unbound-1.17.1-22.oe2403sp1.x86_64.rpm",
"unbound-1.17.1-22.oe2403sp1.x86_64.rpm",
"unbound-anchor-1.17.1-22.oe2403sp1.x86_64.rpm",
"unbound-debuginfo-1.17.1-22.oe2403sp1.x86_64.rpm",
"unbound-debugsource-1.17.1-22.oe2403sp1.x86_64.rpm",
"unbound-devel-1.17.1-22.oe2403sp1.x86_64.rpm",
"unbound-help-1.17.1-22.oe2403sp1.x86_64.rpm",
"unbound-libs-1.17.1-22.oe2403sp1.x86_64.rpm",
"unbound-utils-1.17.1-22.oe2403sp1.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP1",
"name": "unbound",
"purl": "pkg:rpm/openEuler/unbound\u0026distro=openEuler-24.03-LTS-SP1"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.17.1-22.oe2403sp1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Critical"
},
"details": "Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0026apos;s entire event loop for as long as its writes stay ahead of the drain.(CVE-2026-80225)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.(CVE-2026-81634)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.(CVE-2026-82717)",
"id": "OESA-2026-4148",
"modified": "2026-09-30T13:47:04Z",
"published": "2026-09-30T13:47:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4148"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80225"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81634"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82717"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "unbound security update",
"upstream": [
"CVE-2026-80225",
"CVE-2026-81634",
"CVE-2026-82717"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.