{"id":"CVE-2026-81642","details":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.","modified":"2026-09-24T15:11:42.074494479Z","published":"2026-09-16T09:17:06.320Z","related":["ALSA-2026:70754","ALSA-2026:71419"],"references":[{"type":"FIX","url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nlnetlabs/unbound","events":[{"introduced":"0"},{"fixed":"13b6717f1716810523ffb60f971a6c9c5e8ce127"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.26.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*"}}],"versions":["release-1.26.0rc1","release-1.26.0","release-1.25.0","release-1.25.0rc1","release-1.24.0","release-1.24.0rc1","release-1.23.0rc1","release-1.22.0","release-1.22.0rc1","release-1.21.0","release-1.21.0rc1","release-1.20.0rc1","release-1.20.0","release-1.19.3rc1","release-1.19.0rc1","release-1.19.0","release-1.18.0","release-1.18.0rc1","release-1.16.2","release-1.16.1rc1","release-1.16.1","release-1.16.0rc1","release-1.16.0","release-1.15.0rc1","release-1.15.0","release-1.14.0rc1","release-1.14.0","release-1.13.2","release-1.13.2rc1","release-1.13.1rc2","release-1.13.1","release-1.13.1rc1","release-1.13.0rc4","release-1.13.0rc3","release-1.13.0rc2","release-1.13.0rc1","release-1.12.0rc1","release-1.12.0","release-1.11.0rc1","release-1.11.0","1.11.0rc1","release-1.10.0rc2","release-1.10.0rc1","release-1.9.6","release-1.9.6rc1","release-1.9.3rc2","release-1.9.3","release-1.9.3rc1","release-1.9.2","release-1.9.2rc3","release-1.9.2rc1","release-1.9.2rc2","final-svn-state","release-1.9.1rc1","release-1.9.0rc1","release-1.8.2rc1","release-1.8.1rc1","release-1.8.0rc1","release-1.7.3rc1","release-1.7.2rc1","release-1.7.1rc1","release-1.7.0rc3","release-1.7.0rc2","release-1.7.0rc1","release-1.6.7","release-1.6.7rc1","release-1.6.6rc2","release-1.6.6rc1","release-1.6.4rc2","release-1.6.4rc1","release-1.6.2rc1","release-1.6.1rc3","release-1.6.1rc2","release-1.6.1rc1","release-1.6.0rc1","release-1.5.10rc1","release-1.5.10","release-1.5.9rc1","release-1.5.8rc1","release-1.5.8","release-1.5.7","release-1.5.6","release-1.5.6rc1","release-1.5.5","release-1.5.5rc1","release-1.5.4rc1","release-1.5.4","release-1.5.3rc1","release-1.5.2","release-1.5.2rc1","release-1.5.1","release-1.5.1rc2","release-1.5.1rc1","release-1.5.0rc1","release-1.4.22","release-1.4.22rc1","release-1.4.20","release-1.4.19","release-1.4.19rc1","release-1.4.18rc2","release-1.4.18rc1","release-1.4.17","release-1.4.17rc1","release-1.4.14","release-1.4.14rc1","release-1.4.13","release-1.4.13rc2","release-1.4.13rc1","release-1.4.12rc1","release-1.4.11rc3","release-1.4.11","release-1.4.11rc2","release-1.4.11rc1","release-1.4.9","release-1.4.9rc1","release-1.4.8rc1","release-1.4.7","release-1.4.7rc1","release-1.4.6","release-1.4.6rc1","release-1.4.5","release-1.4.5rc1","release-1.4.4","release-1.4.4rc1","release-1.4.3","release-1.4.2","release-1.4.1","release-1.4.0","release-1.4.0rc1","release-1.3.3","release-1.3.3rc1","release-1.3.2","release-1.3.1","release-1.1.1","release-1.0.1","release-0.11","release-0.10","release-0.8","release-0.7","release-0.6","release-0.5","release-0.4","release-0.3","release-0.1","release-0.0"],"database_specific":{"vanir_signatures_modified":"2026-09-24T08:06:50Z","vanir_signatures":[{"source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"function":"val_verify_DNSKEY_with_TA","file":"validator/val_utils.c"},"deprecated":false,"digest":{"function_hash":"133738240329147220400380053903617723423","length":3387},"id":"CVE-2026-81642-02954d00","signature_type":"Function","signature_version":"v1"},{"target":{"file":"services/authzone.c","function":"auth_zone_verify_zonemd_key_with_ds"},"deprecated":false,"digest":{"function_hash":"96299169091753136244253763572590834481","length":1546},"id":"CVE-2026-81642-040700f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"digest":{"function_hash":"101046060531925859697415020789341211709","length":8231},"id":"CVE-2026-81642-1001e60c","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"iterator/iter_scrub.c","function":"scrub_normalize"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"318344754784955354990051982871584516852","length":1779},"id":"CVE-2026-81642-116617e9","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"function":"dnskeyset_verify_rrset_sig","file":"validator/val_sigcrypt.c"}},{"digest":{"length":4760,"function_hash":"236326672551352034962011009276167739140"},"id":"CVE-2026-81642-11c637d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/validator.c","function":"validate_msg_signatures"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"util/config_file.c","function":"config_create"},"deprecated":false,"digest":{"function_hash":"295895874987549045144741286909826243153","length":11222},"id":"CVE-2026-81642-13ff3793","signature_type":"Function"},{"target":{"file":"validator/val_nsec.h"},"deprecated":false,"digest":{"line_hashes":["85415614051202297137396798286923066917","126569858019530298358325869076023881919","238677451849705767152356363889393988093","161497320021214051737232632556020870872","91980753769126378185227046424684314901","141222701503917362195128893348944301988","249778979008612422528169763595296833575","217483292839511987481289037305841271562"],"threshold":0.9},"id":"CVE-2026-81642-14c69603","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"iterator/iter_scrub.c"},"deprecated":false,"digest":{"line_hashes":["224613383889094444919141116487876818080","148243162125509292306467523518966494743","62352699962656271810640486869666228338","306779408770141978681946613178227739701","11957886253441715066596483373573379491","148243162125509292306467523518966494743","139385357781320461140416576287124167652","109297757310233690802732635591279625497","275954224748093051682688227140124374278","12495064624506303604269857934636909734","255293910374300928713523400211182798363","80455592063096950737217813918384665392"],"threshold":0.9},"id":"CVE-2026-81642-15b02b89","signature_type":"Line"},{"target":{"file":"validator/validator.c"},"deprecated":false,"digest":{"line_hashes":["176952441735611161210626471286604918259","234285770487921614302722338690571232472","152034085893302765241264761939884677861","321856300471717210122714247238012184210","18333339537542703530108201338209707336","183210699744247538599410335195657104274","41341232285576827231084214985090435068","266067831480383014407557536741684478139","279139097121976754723098952754435619084","290116035708696520208814645383349064262","40871188566960555797534865343993917120","183033105939759325424076678011545831235","169465767296145533299447362773860448423","30849405903849792555713994679504412217","31444790431828796571394817150690565800","30870410856375171367895296946685568577","929158755411774555991299883488699736","278129556175960818409168623794882495860","321891336264136995275684200022027484749","231189637265704658203190785131713075330","106082789382828069757434483544945964811","96257104728821439688833611620374460073","92072683284179402939465467334695610395","95394415563748866925141912202992260988","167775919579661674957295625944920103198","107401749675874074967051801621171667296","128768282604556112993688077445658227204","50650211212852985222201065585975730202","253197925072238309026186430292741512409","170938158987213126064141904627285519756","101798477808465017159098042304151485516","321094983671346410380837991996312017185","314137676669158173266694174849181499403","279003020386089512361134556093375191482","166604550944875714931445234274761871112","241959742520588141771037338959041638519","143682045381884550727919841994070083790","254195305640439706028135542289171293865","279623437571332528715202776639316527072","292401017837711493172185265434712006669","318828524844303316651291485574250000506","299874137289354296940616449772547372544","293596567179757458712578214589018525315","244472228824253873659612097970849866463","17271159289481317441167346308290111611","4385261960489354563032496518759900607","146673454218694529710990489196036943365","169983916285338084387555772358153733206","271557969733802397187269039228466970040","77197126669793186772428330226408726591","70822625212478219623895806937924216729","312836673160134962599059127065135930870","75886624995191013902422858596611710525","31895623311513514899880969336673898995","186655235839624681954515826629790879404","278321400284147755157964530886978758835","175870229444453867702131809724278902102","228562441234633053971092981742816684515","39016517280665005980760585393325789995","306109999335394257004094167684212386012","291471296188270512196286994158254077866","228654386708472915394724100182283584990","31291345076014932626740110780324253179","142596532920525778340895864897312425273","72972022983663501118727472027505078484","197571508524469218654451752239104227162","746082006143171193157459394666231219","156512340900857884950536590318004753489","229684898828888816672077398182478764587","97976477664310644948569544497480450212","239643110850400552139526756754887738005","159660419445713341862036617572328759192","126387658536707360804693076488895715810","39225837256701334734537292441306614823","311873751585110291758084139180768062403","86205256339234772830566265867412345832","159349538458931244133869531251845518743","317287154413926722803039153964897379820","110213225381222899060565935865926903548","217984667212369491244034936027909380631","115336080439312305264987670389963095695","97825677882723777608211370857223925256","153596904554773920367003142792357074322","325886161564106873766506968625205894078","249928927997909330896319716625549727420","294894608526014095797405053691572844037","159152685145655421845585474728668829947","80883774376547422197538511691445862513","96761198575597881156350706795342775944","14297773022531894076181545891457799355","53493396015941371289160439630077141288","285979774408082438780172402954692445907","327788293682031340151129927137559348356","163763878062103312234482701647103493479","166874529114198514491402079767791522096","195508533882301938972396126086219876571","16927556769915861806896074212464983056","103374044086595304894000218113504058061","51109693553747357604401996387738596122","67993302411006735541372666993955838737","17229918980693360700426767839198166685","291921101415422851481801606087751017631","73433677157808523666487540895792693510","201427415256734178148372645896337755737","82778015328237059473379068395628641979","80676355581872694587491977186551459168","119810278588197484162236997230235759943","212938300879065931162054957521466176095","175560294011057803470618952391047350874","254985523817664165386020418658249987511","101183239762511182964037658062969890475","201427415256734178148372645896337755737","37234883261428085209337752219979590500","163519294835338365353281189777185152778","12619107680859893913890154499933183317","183655082417781845144208441746802976460","201265148721935396345588440930734591262","265752422298429917504177792417631147651","154183666375017121933017456916444179752","291840325347611077712392588866669477498","261686710564316053079786387643574656395","201086419305859884384923130570754017334","164003982230815581019044561848582363033","315677995129798889449834017304141150606","139272500519202853318515039461838021047","259933338954266494200091679419282628373","100061640226572026608932467268153611907","31013203822578614497775486339449105365","41929741940082678771699412247932187619","205266028914225956371641953558683006728","89632866623487487006881733932701602462"],"threshold":0.9},"id":"CVE-2026-81642-18f7e3c6","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"id":"CVE-2026-81642-1bdb4578","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/autotrust.c"},"deprecated":false,"digest":{"line_hashes":["287684708938317071000718737909685084212","60182841319436192450592341004175912881","67232321781299551326423991541493434316","83550154703509892510764945421259649040","265561201479332134719315099284255105889","177617952339977844865171389336809075970","77963379193690167086656661783339687351","210385410557400710400442423754498004772","283966011428081329299149908269548229873","66406449065389695850311821483063889575","133805226271789177153887574662462168199","218564269609564089326274424870833199982","206180961860865205698409536606487090485","62808347173951331129039112525801504446","58346154534880423879911968911278837063","133213894428317761582360617426942881727","124774212668184238757350868184785020634","58727203229095391074331742977856408286","58889286539143334324835078528771674111","297077989941368608246513399386897399752","311906579544789463516753723085518449027","244030781310848272426618758842654025046","336214642306619773668146413451205504800","271660465014777011163512183682413076371","288236433908109195105505804636990340032","153033207373855322681638534924768752897","23222656618338610489244744417963450924","213575215620785310637003447408754801916","118030113809741808370898649588419610397","128263917341190994401731060851264100657","142788790073114303352550640366267479182","59168484489192763182842822147400540506","187988628321591735855181695807319979204","225975941201996585840862643135859205845","159945749172644024339471404054996999870","147496073255512204833803139748535075210","71133353020720853979408030399379132710","89904438079566827379377930498747638504","325294222290054380506277001357279119211","131500045936349422228397757821566867622","87388984181762163370608490673412121717","48138432285366297661155700548539546154"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/autotrust.c","function":"rr_is_selfsigned_revoked"},"deprecated":false,"digest":{"function_hash":"15508639410326137847491849288189639153","length":370},"id":"CVE-2026-81642-26df1586"},{"target":{"file":"validator/val_sigcrypt.c","function":"dnskey_verify_rrset"},"deprecated":false,"digest":{"function_hash":"183176559843514801372222457704635030531","length":1720},"id":"CVE-2026-81642-2c403230","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"target":{"file":"validator/autotrust.h"},"deprecated":false,"digest":{"line_hashes":["115435708257772620737270896092054705382","133378365252424906759788001192637579362","154660114620328959562264550678180947429","95398418845787287576613713477610576829","280419680011907176744124764494812635197","326529579562433803590144656442229653651","87862392770572422269291052638569762067","190721499126168789302917477417034574232","174949839084775076087088445228149423576","56489881227095512753548998613831473416"],"threshold":0.9},"id":"CVE-2026-81642-2c615b1c","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"function":"val_verify_new_DNSKEYs","file":"validator/val_utils.c"},"deprecated":false,"digest":{"function_hash":"193026013815338507742318251255376713251","length":959},"id":"CVE-2026-81642-2cfd3994","signature_type":"Function"},{"id":"CVE-2026-81642-2d397a77","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_nsec3.c","function":"nsec3_prove_nods"},"deprecated":false,"digest":{"function_hash":"8721164649567122305544291373235690480","length":3052}},{"target":{"file":"testcode/unitverify.c"},"deprecated":false,"digest":{"line_hashes":["106451652729516793172304973740682608925","122852487820697625989645460459430934124","124510972929533222252929968131682076744","298416818932956420646850845086789681787"],"threshold":0.9},"id":"CVE-2026-81642-3002fc0f","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"deprecated":false,"digest":{"line_hashes":["36318411145144104721810321403623170690","55191812989834723708591725201125833215","102633493277703505025255402337254049078","47396504054858235881929991791445811340","56824479459960255560318537813541723340","230470549026422570961149510132421426118","56361276013393452979649938793438666144","41114703350754156147108196783734368422","187950964235946809660480476970952276107","295004693239130472588305522194837209800","79587590629158247235134427494102185251","119533506287659300469987311396350029230","40333548364805332588220172092779161239","285017694456247156294885408647598621977","156978170905663313951113986484169700740","277655852920827321299687373385347465866"],"threshold":0.9},"id":"CVE-2026-81642-301fa8c7","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_nsec3.c"}},{"signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"function":"zonemd_dnssec_verify_rrset","file":"services/authzone.c"},"deprecated":false,"digest":{"function_hash":"157335378341079696530382583970980670821","length":1271},"id":"CVE-2026-81642-356c4073","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/validator.c","function":"primeResponseToKE"},"deprecated":false,"digest":{"function_hash":"268362198651416454311539858484188509877","length":2451},"id":"CVE-2026-81642-367851cc","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/validator.c","function":"ds_response_to_ke"},"deprecated":false,"digest":{"length":6725,"function_hash":"44231920221790290732008186940159213306"},"id":"CVE-2026-81642-3f4fb42f"},{"signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"services/authzone.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["268441898132226957531784789837726685386","269904497495247544529701900466794796081","267951565426062484944560569805144765653","79945851874315680061831258947306234137","245854929813864600555575718830207184703","196508519204149122042510777976098758766","49724733563844911303111219564295485222","70871651903356636694677145985873303156","28180252359394380574711430267519239743","120503029763904138527824246910466375847","97368905119753989791032472074903323993","297592842488488618354874493453022978281","263932750120185991057552651779075188099"]},"id":"CVE-2026-81642-44c9db50","signature_type":"Line"},{"source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"testcode/unitverify.c","function":"verifytest_rrset"},"deprecated":false,"digest":{"function_hash":"275266489265866845017698345087894926249","length":751},"id":"CVE-2026-81642-4af6fa7e","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/validator.c","function":"processValidate"},"deprecated":false,"digest":{"length":6531,"function_hash":"168087640512661391008236633334234342797"},"id":"CVE-2026-81642-4b091486"},{"signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"daemon/worker.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["80663279318888019666333332133090562765","305810827958098835502516574473593111104","303825507901108057053579422554356638111","238984039883571728986464702536371743790"]},"id":"CVE-2026-81642-4e175ff5","signature_type":"Line"},{"target":{"function":"list_is_secure","file":"validator/val_nsec3.c"},"deprecated":false,"digest":{"function_hash":"256680877739384910573520972992869023482","length":914},"id":"CVE-2026-81642-4e4f784c","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"target":{"file":"validator/val_sigcrypt.c","function":"dnskeyset_verify_rrset"},"deprecated":false,"digest":{"function_hash":"203077376611039325965994071657044973451","length":1813},"id":"CVE-2026-81642-621eb9da","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/validator.c","function":"process_ds_response"},"deprecated":false,"digest":{"length":2093,"function_hash":"240423281618685930072891179024397305349"},"id":"CVE-2026-81642-65f72d45","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_utils.c","function":"val_verify_new_DNSKEYs_with_ta"},"deprecated":false,"digest":{"length":983,"function_hash":"251962371907779194304309597617476777126"},"id":"CVE-2026-81642-6bb421be","signature_type":"Function"},{"digest":{"line_hashes":["44629130320814867764758833688480719464","178475910317444853121240364906103987820","246807232318518577235005015469743207009"],"threshold":0.9},"id":"CVE-2026-81642-6f94ae87","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"util/data/msgreply.h"},"deprecated":false},{"id":"CVE-2026-81642-6fdb2151","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_utils.c","function":"verify_dnskeys_with_ds_rr"},"deprecated":false,"digest":{"function_hash":"174383141053106646390186647584105326600","length":1684}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_utils.c","function":"val_verify_DNSKEY_with_DS"},"deprecated":false,"digest":{"function_hash":"333959082296665136293984117493564651497","length":2065},"id":"CVE-2026-81642-70fd244d"},{"signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"util/config_file.h"},"deprecated":false,"digest":{"line_hashes":["334358469208717528013548445658158398893","178812717813036033751855691546626497632","197387873122575889130168923496425301228","92028123241324297066317702078362385654"],"threshold":0.9},"id":"CVE-2026-81642-7824f6e9","signature_type":"Line"},{"source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"function":"config_set_option","file":"util/config_file.c"},"deprecated":false,"digest":{"function_hash":"202841505302604909445829607356016028396","length":20106},"id":"CVE-2026-81642-815d0a36","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"services/mesh.c"},"deprecated":false,"digest":{"line_hashes":["319091500061022772866715753192531077080","79412188398403135221207755056893682632","198552030842832236934644740953391469701","127348886901253850784607025321036203957"],"threshold":0.9},"id":"CVE-2026-81642-91ef9e33","signature_type":"Line","signature_version":"v1"},{"target":{"file":"validator/validator.c","function":"val_restart"},"deprecated":false,"digest":{"length":281,"function_hash":"182534327225361706684520150496139873127"},"id":"CVE-2026-81642-946a1a53","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"digest":{"function_hash":"228695233199518345480607604546306117935","length":2201},"id":"CVE-2026-81642-976b3af9","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_nsec.c","function":"val_nsec_prove_nodata_dsreply"},"deprecated":false},{"source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"services/cache/dns.c"},"deprecated":false,"digest":{"line_hashes":["14425555859220980481810675745866448681","120691736543837508737502352337615460518","123611377716702575083986161034922457793","41477461608839807735071204480639815496"],"threshold":0.9},"id":"CVE-2026-81642-9a115eed","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"226284017144833596694655187250435455938","length":1795},"id":"CVE-2026-81642-9c483d5c","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_utils.c","function":"val_verify_rrset"}},{"source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/validator.h"},"deprecated":false,"digest":{"line_hashes":["220093004405151520725230189690749365651","263909593548192473569500080268799928643","123074349695489236418460854408463734493","113777093906453887655914467614200676566"],"threshold":0.9},"id":"CVE-2026-81642-9c6bea45","signature_type":"Line","signature_version":"v1"},{"target":{"file":"validator/validator.c","function":"process_prime_response"},"deprecated":false,"digest":{"function_hash":"200222811413730486364188934877794028123","length":1631},"id":"CVE-2026-81642-9f066f9a","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"function":"config_get_option","file":"util/config_file.c"},"deprecated":false,"digest":{"function_hash":"170468407167350036052624824842444303405","length":20097},"id":"CVE-2026-81642-a5c69564"},{"digest":{"threshold":0.9,"line_hashes":["156295280357219608306503217253163585699","119571599660632578590428711401561854847","336783067128924650448297081090362464123","215925221284386987876620455425866011976","106981085733261372503092889331889086122","270760071803341209799226083781109232061","179271544565832125836380573090119066568","158385849774281480694601992421535014674","214627381362922431453668350794294506556","299012497109453703212115046910295582633","297231590925649291897448043505803245815","149725252527761562259277921272815438919","215449240747486309951983528578975823422","77790324230058290909852916969121654960","43784351428597498976713694066147540604","329091334654911455826656079145291361273"]},"id":"CVE-2026-81642-ad81d5b8","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_sigcrypt.h"},"deprecated":false},{"id":"CVE-2026-81642-b3fe172e","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"function":"processFinished","file":"validator/validator.c"},"deprecated":false,"digest":{"function_hash":"151184495307779977107430289013149144712","length":6718}},{"source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/autotrust.c","function":"check_contains_revoked"},"deprecated":false,"digest":{"length":1309,"function_hash":"99725807223606614424567891685752405805"},"id":"CVE-2026-81642-b9ef8fd3","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-81642-bc4358d8","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"util/config_file.c"},"deprecated":false,"digest":{"line_hashes":["11546182213995892802606948206822368472","278662952865882190823164307572848894953","249327156249605261818880813524748378345","162589435365582844568836240046573649592","56095124214184659174886344480222904524","93872746458970214607810708403105822695","92797348459884455635691727175883323913","127472079332990592254974845680088852217","18066472570619255288334390772494239005","150340897653200721543467357709634584432","156598842484074573209172961131610750397","17713086053873407875848450361192129196","215228077837290531289465242190644153745","35302033970536058784421839092552861637","287071648983962268444950693772762237178","121363082572978537956150525171167576404"],"threshold":0.9}},{"id":"CVE-2026-81642-bd2f94ce","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_sigcrypt.c"},"deprecated":false,"digest":{"line_hashes":["254715015548548748750572767962295658931","2723908961071407391641540482290934213","20118294667426708525201549245103931835","267483435335305382631976505849682018164","301583343374354685845575755252003802481","157471762570617918185706496109080764495","151608963519884250216523602614795163539","38685724122924032038342939044693119859","330779577431055817084436537929523341908","244376249472138300584376755619299673682","157235387496626740852981149024108543379","159352272956980068019467904899228535290","169419973826436115908054917889185734899","132620765950273664736441463053810685934","299279536307383057552509998716337385087","284276630403513470526492579541880639597","186991799065212742743614953751839999147","4924472245167950791714629473922461428","305953710681939259850434752498270766925","145235471981375540491283479671479282855","315969457971379160897120241160545203745","261096573693841563241958211150330488510","290378803764395934191687296154338298579","273914201825281677904795320517645592918","82222509375275579578513830426895491627","33417375324436319916311668906775352299","87613811973294202238081199440777011157","254331255761200284716874824741847217361","189130453936395815404547617344157197095","56660495315838272672096175158812367235","36162637479534680669298188582097987068","70362489099677407115755371737852664588","40964171098142561673754616188865081973","264111338932123760121117790996678852569","281997046112541488510418637497618675075","101625134934509735993930849700312428644","192132717315979142217146217808373557707","149644779787680922521425732029913657590","154355290525288680936919304437217763015","130393560335189018090028581680381127736","162439272403608898187047618381403718840","192109719813649563981921298121468154068"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/autotrust.c","function":"verify_dnskey"},"deprecated":false,"digest":{"function_hash":"334119925918273034223109564754931838519","length":518},"id":"CVE-2026-81642-bf496ea1"},{"deprecated":false,"digest":{"function_hash":"317356488548573546686410107774867419121","length":699},"id":"CVE-2026-81642-c19ca707","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"function":"nsec_verify_rrset","file":"validator/val_nsec.c"}},{"id":"CVE-2026-81642-c3e84f77","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_utils.c"},"deprecated":false,"digest":{"line_hashes":["102403022839627119539022724296074802079","145235471981375540491283479671479282855","315969457971379160897120241160545203745","67082598222119921241059501622063560314","98588424166388884012551205717305726898","180873809508882261867039600973807623864","253375903690283279630496626259657583001","222889794253014641270701838653204563228","65032127766851801180881495003643775521","324989399533393798892810071007152016234","281617780502367145334617725584419310071","17380358336173338148850602414853218630","150367791477241382655737577018866528668","93874079485278369358690335950207351419","171968281456060538565208308055867865673","69316395600601333431798532036500569696","261634323759010640975488847749310469429","285015352907935791388041510033681683596","164224914833350871693619464991217948710","279350073022977108973394187893988957215","44830838904525826037230527647366665979","79632765055986078388876216496768690021","79670321400333064581021388625118832560","297337957495034012424593553171717015980","90461828606588721100139566126556280067","219945506967058250176386232051770114631","141454536512940473155249277483011962314","113910645822068038992405063844918066363","97601596540978497398904141401543229685","53177777544646573059378299852230862667","244476219552264383386712027164279959513","43623167625764625110458737381412658054","17344436577259944705545900591530548630","200731396163922285019276289863240455470","113495434204459429835024754022915657382","131128939844683770692349291581159455776","156887075622870342617442285348599572228","169185064245968715201559754457833275504","87200135617618836461340074557989319856","203202987931845018763078259118846875024","214881576914713670245410732389181253570","81664281944063319732435511857143911623","113656277639557872253521059890602138702","279325710233917797181312080949622070473","29984714698584690912409645884732929639","159057388635567871158365948647451157807","288519765340810653062988383673274592024","264803593322946841035103734241603733844","244557388705667608856971043393031622048","116452490186735727192998532251087798085","212076034505162100767488015180138290477","302705810960045389058862816238374454802","212882618508420059449194707175943636977","231851281827763814591920344841611244415","131672276238633266847161131096198536575","65510502658819620304707443094602959133","293607168322769943938465555096253583012","220545133910282259786850479856264773430","52458999231164139351732403185464766654","330156885456473030872495887026885150964","36483119169840663933737596829431703690","255189328645717575654968038752285725820","66871882396338308569690919846774221312","16769873242512239332043830957924532670","97169792338091631646090238349991873422","78631483081920780456809518569745923791","264762882873883418180752507326042701822","198293491713598803228094707030292394653","214881576914713670245410732389181253570","305624505335978584633242133733251294030","261078283110135953295068733601591288115","34279153444843365949185337720717480142","323988074594725543320573653298128331009","132221596314700244530224543582743472644","106823766818360762651407169798351945482","247573534871857436722788435721204627289","134270545359439690791350668242831578980","142224217344467124606436754496918636532","336021278533374339555202734534532216454","110011817298572047453280044606540744457","115588593303918441467745649319392419617","179842769771087686083497235261065006294","197980818582102544543225207302588811381","140855595672954215407807773350927121115","310381695365301475700701416871884889761","203724205738672268079847689380935950203","195690155192192665673837924691157739705","327857181850240715005503484541400876439","15926942278425337671014820840459404289","131056003846299843680982316716448727005","144023815333661147097629804854181906302","191017092654007813656873941398880570860","156422708400461459964956731122467615794","80111866496520462919898855780174990434","229308621043308591724925301840561758706"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/autotrust.c","function":"autr_process_prime"},"deprecated":false,"digest":{"length":2302,"function_hash":"308908246330222942840539680862892737439"},"id":"CVE-2026-81642-c50e754d","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["98164273336271896720738794542806915729","23328255003035804449376232652113623222","175020434598040000770047213626483919922","148635161593389068496314415409538500969","67661382736516239276298084599411306306","298099716530652761860834143380601389338","286280504397741778445071458417887733455","98976675950558664696790236665043194318","98989087802755228569834616587821037897","47867635026810648482744539783455330861","258475575433399762035133140812758034829","256627869906658627396094437957501597442","82530685418082124092043546236442217943","45986885383282622068384139795489635229","53196639426268210524386978897362081740","328677176763140763163432206198695643773","109978428423318367640769412095830003727","268976709058552804456337214768376477304","94150867084557971034566522368573218469","260829442731646129086456525219974797583","161289169482435677083332172226573310288","304139431254909219299878654073702373197","37485259202691399453846239527337010325","227800179398578448163846291598138411728","108907394990763897164665816060809195063","19573203833596498794474525536315122888","172858678737748666351489928341210119507"],"threshold":0.9},"id":"CVE-2026-81642-c7bb0ea6","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_utils.h"}},{"target":{"file":"validator/val_nsec.c"},"deprecated":false,"digest":{"line_hashes":["332752335924943781165399982247129577631","279163358960086805063322244641838186788","334867790730169925691088082544481053449","160229904185538093426930006506132380420","298143408129669625692950632359997756383","339010851502629764772036927163415431203","61461704348587172704568920100959796651","100289280571091775594389814756490440315","293609826728682841471768457840117643691","317436375906459942822963387485248425339","229401744816733671066402618175589062912","282564025107316680937345134409878820887","313716624414682133839300888846474065397","107115130149376136898312514533681614373","72422965365055378565418347010416797977","20556578764109336971470283592726323090","28258077390683836424433648790704290791","84100831344655952133979495808799734204","151121673266717540858290073865468032084","291229139484443557021767146319818341379"],"threshold":0.9},"id":"CVE-2026-81642-d29fa731","signature_type":"Line","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/validator.c","function":"validate_referral_response"},"deprecated":false,"digest":{"length":402,"function_hash":"112043531350048462942899732105303043970"},"id":"CVE-2026-81642-e43dfb41"},{"digest":{"function_hash":"112542181291155167444524194783499884430","length":10427},"id":"CVE-2026-81642-e6f0082d","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"daemon/remote.c","function":"fr_atomic_copy_cfg"},"deprecated":false},{"source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"validator/val_nsec3.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["60324076669479596792322322114451284115","115255629373399623059270248640586867677","72832053688431158578248399650425454699","87592117946490128296566617629018051950","284161402370759879803137480597002236222","36199659633947434494571858482393789756","32246531304923080050607783376186294565","332522266859722123837152599177609717282","54132420384778855003459634704895144723","72861908437892067255754889248263098446","141007549604919717575016752881921311994"]},"id":"CVE-2026-81642-e79f0047","signature_type":"Line","signature_version":"v1"},{"target":{"file":"validator/validator.c","function":"process_dnskey_response"},"deprecated":false,"digest":{"length":2958,"function_hash":"169844769176545712043782910905840735467"},"id":"CVE-2026-81642-eef5ae4c","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"file":"daemon/remote.c"},"deprecated":false,"digest":{"line_hashes":["237568473347476949439640547552293307618","134455189021174722152286003813235212195","294223841833031920563697196887522123883","71927006080256814152874265919760846841"],"threshold":0.9},"id":"CVE-2026-81642-f62cd653","signature_type":"Line"},{"target":{"function":"zonemd_get_dnskey_from_anchor","file":"services/authzone.c"},"deprecated":false,"digest":{"function_hash":"113147362585857422654104573289701277040","length":1562},"id":"CVE-2026-81642-fa2a0f82","signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nlnetlabs/unbound/commit/13b6717f1716810523ffb60f971a6c9c5e8ce127","target":{"function":"val_verify_rrset_entry","file":"validator/val_utils.c"},"deprecated":false,"digest":{"length":681,"function_hash":"277286141403348450359948210256583726382"},"id":"CVE-2026-81642-fca08659"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-81642.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}