CVE-2026-81642

A flaw was found in Unbound's DNSSEC validator. A remote attacker can exploit this vulnerability by controlling a malicious zone and sending a specially crafted DNSKEY record. This can lead to a heap buffer overflow, potentially resulting in a denial of service or remote code execution.

A CRITICAL severity flaw was found in Unbound's DNSSEC validator as shipped in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and the hummingbird-1 hardened image. When digesting DNSKEY records, a DNSKEY whose owner name contains a compression pointer into its own RDATA can overflow the digest buffer, causing a heap buffer overflow. A remote attacker who controls a malicious DNS zone can exploit a vulnerable Unbound resolver by getting it to process such a specially crafted DNSKEY record, resulting in denial of service and possible remote code execution through attacker-controlled data; exploitation requires no privileges or user interaction (Red Hat CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, matching the NIST score). The unbound component in RHEL 7, 8, 9, and 10, Red Hat In-Vehicle OS 2, the hummingbird-1 hardened image, and the Fedora community distribution are affected, and fixes have shipped or are being pursued through the delegated business-unit errata process. OpenShift Container Platform update streams have been assessed as not affected. The rhel-6-els stream is out of support and is not receiving a fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.