NLnet Labs has disclosed a critical heap overflow vulnerability in the DNSSEC validator of the Unbound DNS resolver. The advisory covers every release before 1.26.1, meaning a large share of existing Unbound deployments are exposed. The flaw can be triggered when an attacker who controls a malicious DNS zone causes a vulnerable resolver to query that zone, potentially leading to remote code execution.
The severity stems from Unbound's role as a validating, recursive resolver: DNSSEC validation happens automatically for normal queries, so the vulnerable code path is reachable without special access. The maintainers have rated the issue critical, and no partial workaround is mentioned in the advisory.
Operators should update to Unbound 1.26.1 as soon as possible, as that release contains the fix for the heap overflow. Until then, vulnerable resolvers should be considered at risk from any untrusted DNS zone they might be asked to resolve.