CVE-2026-82717

A flaw was found in Unbound. Improper handling of buffer positions and compression pointers in Unbound's CNAME synthesis allows a remote attacker to corrupt heap memory via upstream DNS responses. This vulnerability can result in a denial of service (DoS) or, under specific conditions, remote code execution (RCE).

This is an Important vulnerability in Unbound that could lead to remote code execution due to heap memory corruption during CNAME synthesis. As Unbound is a critical DNS resolver component in Red Hat environments, successful exploitation could severely impact service availability and integrity. The complexity of exploiting heap memory corruption may limit immediate widespread attacks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this restrict Unbound to trusted clients and limit which upstream name servers it can query. If Unbound is unused, disable or remove the service. Apply process/cgroup limits to contain crash impact.