Ubuntu Unbound CVE-2026-81634 and 7 More Flaws: Check DNS Patches

While reviewing Ubuntu's Unbound notices, I saw that USN-8946-1 was dated 21 Oct. 2026, while the CVE-2026-81634 page linked to USN-8946-2 dated 10 Nov. 2026, but I could not open the latter notice, so I cannot yet establish its patch coverage. I selected 8 vulnerabilities relevant to DNS resolver operations to check. These vulnerabilities already have upstream advisories, and each has different conditions.

What happened to Unbound

Unbound forwards DNS queries, caches answers, and validates DNSSEC. Some vulnerabilities are triggered by answers from an authoritative server controlled by an attacker. Even a resolver that does not accept public queries can still be at risk. If the resolver crashes, websites, apps, and mail systems using it may also lose name resolution.

The main issue, CVE-2026-81634, occurs during RRSet canonicalization before DNSSEC validation. The code calculates the buffer size without counting the owner name of the first record. If the queried name is 255 long and a large TCP response arrives, it may write beyond the heap buffer. The attacker must control the nameserver sending the response or be able to modify the response in transit. Enabling DNSSEC therefore does not prevent this vulnerability, because the problem occurs before signature validation, according to the NLnet Labs advisory.

Read severity scores together with their sources

For CVE-2026-81634, Amazon Linux assigns an Important rating and a CVSS 3.1 score of 8.6 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, while Ubuntu's CVE page shows 7.5 High with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and sets Ubuntu priority to Medium. The two sources assign different impacts to data confidentiality and integrity, so 8.6 should not be called Ubuntu's score or used as the score for every CVE in this set.

Ubuntu's page says CVSS v3.0, but the vector starts with 3.1. I have kept the wording as it appears in the source. The NLnet Labs CVE record gives a CVSS 3.1 score of 7.5 and the same vector as Ubuntu. This score assesses that an attacker over the network could make the service unavailable without needing an account or waiting for a user to click anything.

NLnet Labs rates CVE-2026-81634 as High and lists DoS as the impact, but Red Hat says in its Statement that it could also allow arbitrary code execution. The two sources describe the impact differently. This statement of possibility is not a report of exploitation in the wild.

The NLnet Labs advisories for all 8 issues do not state that exploitation has been observed in the wild. None of the 8 appears in the 9 Nov. 2026 KEV catalog (catalogVersion: 2026.11.09), so there are no KEV addition dates or deadlines to cite for these issues. Absence from KEV does not mean no one has ever exploited them.

Affected versions and conditions to check

This table uses upstream version ranges from NLnet Labs advisories. Ubuntu packages may already have patches backported to older versions, so compare the full package version, including the revision.

Check the detailed conditions in the advisories for 32665, 40691, 44690, 50252, 55973, 80225, and 85501.

For Ubuntu packages, USN-8946-1 lists the fixed versions for both unbound and libunbound8 as follows: 26.04 LTS uses 1.24.2-1ubuntu2.4, 24.04 LTS uses 1.19.2-1ubuntu3.12, and 22.04 LTS uses 1.13.1-1ubuntu5.17.

The Ubuntu CVE-2026-81634 page I read still lists Ubuntu 26.10 as Vulnerable, even though it also links to USN-8946-2 dated 10 Nov. 2026. I could not open the USN-8946-2 notice during review, so I do not yet have a fixed package version for 26.10 to cite in this article. Do not use LTS package versions to conclude that 26.10 is fixed.

How to update and verify the result

Check the system version, installed packages, and repository candidates, then compare them with the Ubuntu notice for that release. If libunbound8 is not found, check only the packages that are installed.

cat /etc/os-release
dpkg-query -W -f='${binary:Package}\t${Version}\n' unbound libunbound8
apt-cache policy unbound libunbound8

Check build information with unbound -V, then read configuration values with unbound-checkconf -o as described in the developer documentation. If the service uses a configuration file other than the default, append that file's path after the option. If the command reports an unknown option, do not interpret that result as the feature being disabled.

unbound -V
sudo unbound-checkconf -o dnscrypt-enable
sudo unbound-checkconf -o quic-port
sudo unbound-checkconf -o dns-error-reporting
sudo unbound-checkconf -o aggressive-nsec
sudo unbound-checkconf -o so-reuseport

1. Check scope Record the Ubuntu version, package versions, and enabled features. Back up the configuration before making changes.
2. Compare notices Confirm the fixed versions for that Ubuntu release, including installed library packages.
3. Update Apply patches from the Ubuntu repositories in use, then check the configuration.
4. Restart the service Restart and test name resolution from machines that actually use the resolver.

After comparing the fixed package versions, update through APT. This example applies to a machine with both unbound and libunbound8 installed. If an app has this library loaded, restart the app's process during its maintenance window as well.

sudo apt update
sudo apt install --only-upgrade unbound libunbound8
sudo unbound-checkconf && sudo systemctl restart unbound

Check symptoms after updating and retain evidence

Check the status and logs after restarting, then test DNS from an actual client. Answers and name resolution times should be normal. If it crashes again, collect the logs before changing more settings.

systemctl is-active unbound
sudo journalctl -u unbound -b --no-pager -n 100
dpkg-query -W -f='${binary:Package}\t${Version}\n' unbound libunbound8

The linked NLnet Labs advisories provide no IOCs, such as attacker IP addresses or hashes, to confirm an incident. After updating, check whether the process still crashes or restarts frequently. Check memory and CPU usage; if they are high alongside unusual DNS queries, retain the data for further investigation. Cached answers that do not match zone data also warrant investigation. These symptoms alone cannot confirm a CVE or a compromise. For further system inspection guidance, read Checking Debian server security.

How I would prioritize the work

I would prioritize patching resolvers that accept external queries or are shared by web and mail services, because a DNS outage could stop other work as well. Internal systems should also go into the next available update window. Leaving DoQ disabled does not prevent every vulnerability in this set. For Ubuntu 26.10, verify the status and fixed package version with Ubuntu before closing the task.

Sources: Ubuntu USN-8946-1, Ubuntu CVE-2026-81634 and follow-up notice listings, Amazon Linux CVE-2026-81634, NLnet Labs Security Advisories, individual CVE advisories linked in the article, NLnet Labs CVE record, Red Hat CVE-2026-81634, CISA KEV, and the unbound-checkconf manual. Reviewed on 11 Nov. 2026; the KEV catalog I read was the 9 Nov. 2026 edition. I could not open the USN-8946-2 notice, so I have not yet included an Ubuntu 26.10 package version. I will come back and add it later.