[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9WzApaAsqKuJGlSqDAw7HKV8xJXNIwN5H0cTeJQsFok":3},{"article":4,"iocs":36,"watch_terms":59,"solutions":60,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"833bc3c3-2696-445c-b0dd-0448ee73952e","Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone","critical-unbound-dnssec-validator-flaw-could-allow-rce-via-a-malicious-dns-zone-4341f2","Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. Unbound 1.26.1, released the same day, fixes the bug, tracked as CVE-2026-81642, along with","A critical heap overflow vulnerability (CVE-2026-81642) has been discovered in all versions of the Unbound DNS resolver prior to 1.26.1. This flaw, present in the DNSSEC validator, can be triggered by an attacker controlling a malicious DNS zone, potentially leading to remote code execution. NLnet Labs has released version 1.26.1 to address this and eight other vulnerabilities.","Unbound DNSSEC validator flaw allows RCE via malicious DNS zone.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcritical-unbound-dnssec-validator-flaw.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiiFNFekCjM7qSAMNaeoNatwUPsjJY0Nj67yGKdlhq_zzLH9tyjQrXAByn9B6BvXEcMabyWnO5oWWE11_orN2h7G-7jRjGPSW48xtd4HySWIkI1fQzCbUDCVzRyc_KG3curUoXk4LgyckPwUO8aP65kR0CYnc90pkfXctHKXVQ7grKsc43drFZ63yRur20\u002Fs1600\u002Fdns-admin.jpg","2026-09-17T12:30:00+00:00","2026-09-17T14:00:31.704827+00:00",8,[17,20],{"name":18,"type":19},"NLnet Labs","vendor",{"name":21,"type":22},"Unbound","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,31],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[37,41,44,47,50,53,56],{"type":38,"value":39,"context":40},"cve","CVE-2026-81642","Critical heap overflow in DNSSEC validator",{"type":38,"value":42,"context":43},"CVE-2026-82717","Heap corruption bug in CNAME synthesis",{"type":38,"value":45,"context":46},"CVE-2026-81634","255-length query name with large TCP response",{"type":38,"value":48,"context":49},"CVE-2026-77955","Zones with zonemd-check: yes located below, but not at, a trust anchor",{"type":38,"value":51,"context":52},"CVE-2026-78227","Built with --with-libngtcp2 and quic-port configured",{"type":38,"value":54,"context":55},"CVE-2026-80225","Sustained stream of distinct uncached names over one TCP or DoT connection",{"type":38,"value":57,"context":58},"CVE-2026-82720","Built with --with-libnghttp2 and https-port configured",[18,21],{"controls":61,"vendors":148},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":35,"name":121,"problem":122,"products":123},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":164},"critical-unbound-dns-heap-overflow-enables-remote-code-execution","Critical Unbound DNS Heap Overflow Enables Remote Code Execution","A heap overflow vulnerability in the Unbound DNS resolver's DNSSEC validator allows any attacker who controls a malicious DNS zone to trigger remote code execution on systems running versions prior to 1.26.1. DNS resolvers are foundational network infrastructure components, meaning a compromise can cascade to affect every system relying on that resolver for name resolution. The vulnerability is particularly dangerous because it can be exploited externally by simply serving a crafted DNS zone, requiring no prior authentication or access. NLnet Labs has released version 1.26.1 patching this and eight additional flaws, making prompt upgrades critical. Organizations that delay patching DNS infrastructure risk full system compromise of a high-trust, high-availability service.",[154,155,156,157,158,159,160,161,162,163,39],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-8: Information System Component Inventory","NIST SP 800-53 RA-5: Vulnerability Scanning","NIST CSF ID.AM-2: Software platforms and applications inventoried","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","ITIL Change Management: Emergency Change procedures for critical patches",{"CVE-2026-81642":165,"NIST SP 800-53 SI-2: Flaw Remediation":166,"NIST SP 800-53 RA-5: Vulnerability Scanning":167,"NIST SP 800-53 SI-3: Malicious Code Protection":168,"CIS Control 12: Network Infrastructure Management":169,"CIS Control 7: Continuous Vulnerability Management":170,"CIS Control 2: Inventory and Control of Software Assets":171,"NIST SP 800-53 CM-8: Information System Component Inventory":172,"NIST CSF ID.AM-2: Software platforms and applications inventoried":173,"ITIL Change Management: Emergency Change procedures for critical patches":174,"NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":175},"This is the Unbound heap overflow itself, so tracking it ensures affected resolvers are patched.","Flaw remediation of the Unbound DNSSEC validator bug prevents attackers using malicious zones to run code.","Scanning identifies which resolvers run versions before 1.26.1 and remain exposed.","Malicious code protection on resolver hosts helps limit the impact if the overflow is exploited.","DNS resolvers are core network infrastructure, so keeping them patched and securely managed is essential.","Rapid patching of Unbound to 1.26.1 or later closes the heap overflow that allows remote code execution.","Knowing where Unbound runs, including embedded appliances, lets teams find and patch every vulnerable resolver.","Including DNS resolvers in the component inventory ensures every Unbound instance is tracked and updated.","Inventorying software platforms, including Unbound versions, supports targeted patching of resolvers.","Emergency change procedures allow critical resolver patches to be deployed rapidly.","Mitigating the Unbound flaw promptly, or documenting accepted risk, ensures the vulnerability does not linger."]