openSUSE Patches Nine Unbound DNS Resolver Flaws Including a Remote Code Execution Risk
openSUSE has issued security update openSUSE-SU-2026:22082-1, rated important, which delivers nine Unbound vulnerability fixes and nine bug fixes for openSUSE Leap 16.0. The nine flaws are CVE-2026-77860, CVE-2026-77955, CVE-2026-78227, CVE-2026-80225, CVE-2026-81634, CVE-2026-81642, CVE-2026-82717, CVE-2026-82720 and CVE-2026-85501, of which CVE-2026-81634, CVE-2026-81642 and CVE-2026-82717 are the heap corruption issues. The highest-rated of the set carry a SUSE CVSS v3.1 score of 8.1 and a CVSS v4.0 score of 9.2, and the fix ships as Unbound 1.26.1. Any Leap 16.0 host running Unbound as a recursive resolver, a validating resolver or an authoritative-zone server is in scope.
The advisory describes the mechanism behind each flaw rather than a single attack chain. CVE-2026-81642 is a heap buffer overflow triggered while digesting a DNSKEY record, and the vendor states this may permit remote code execution. CVE-2026-81634 is a related heap buffer overflow during DNSSEC canonicalization, while CVE-2026-82717 allows CNAME synthesis to corrupt the heap. Two use-after-free conditions sit in the encrypted transport paths: CVE-2026-78227 in the DNS-over-QUIC stream output buffer on reset re-transmission, and CVE-2026-82720 in the DNS-over-HTTPS stream cleanup code path. The remaining issues weaken controls rather than memory: CVE-2026-77860 lets the serve-expired feature bypass Unbound's wait-limit protection, CVE-2026-77955 opens a window in which ZONEMD verification can be bypassed, CVE-2026-80225 permits service degradation through continuous queries on a single TCP or DoT connection, and CVE-2026-85501, published as Retrap, describes novel algorithmic complexity attacks against DNSSEC processing. All nine are reachable over the network without authentication or user interaction, which is expected for a service whose entire function is to accept untrusted queries and untrusted upstream responses. The 1.26.1 release also corrects a heap out-of-bounds write caused by size_t-to-int truncation in setup_if() and outside_network_create() for large num_ports values, an autotrust state-file line overflow that could bypass hold-down, and a race condition that caused segfaults when starting threads.
The strategic weight here comes from where Unbound sits. A resolver is the component every other system trusts to answer the question of where a name points, so memory corruption in DNSKEY digestion or DNSSEC canonicalization is not merely a crash risk — it is code execution in a process that mediates the name resolution of everything behind it. The ZONEMD verification window and the serve-expired wait-limit bypass erode integrity controls that exist specifically to stop poisoned or stale data from being served as authoritative. The DoQ and DoH use-after-free bugs matter more now than they would have two years ago, because encrypted DNS transports are increasingly enabled by default on public-facing and enterprise resolvers, enlarging the code paths an attacker can reach. On current exploitation status, FIRST EPSS places the thirty-day exploitation probability at 1.0 percent for CVE-2026-81642, 0.8 percent for CVE-2026-82717, 0.5 percent each for CVE-2026-80225, CVE-2026-81634 and CVE-2026-85501, 0.4 percent for CVE-2026-82720, 0.3 percent each for CVE-2026-77860 and CVE-2026-78227, and 0.2 percent for CVE-2026-77955. The residual exposure is one of accumulation: a Leap 16.0 resolver left on a pre-1.26.1 build carries all nine issues at once, spanning three heap corruption paths, two use-after-free conditions in the encrypted transports, and four control-bypass or resource-exhaustion routes in a service whose entire function is to accept untrusted input.
Attack Surface
Infrastructure, Server OS
Tactics
Initial Access, Impact, Defense Evasion
Techniques
- T1190 – Exploit Public-Facing Application
- T1499.004 – Application or System Exploitation
- T1565.002 – Transmitted Data Manipulation
SuperPRO's Threat Countermeasures Procedures
- Apply openSUSE-SU-2026:22082-1 on all openSUSE Leap 16.0 hosts to bring unbound to 1.26.1, which fixes all nine CVEs including the DNSKEY digest heap overflow CVE-2026-81642; run 'zypper ref && zypper in -t patch openSUSE-SU-2026:22082-1' and restart the unbound service so the running resolver loads the patched binary.
- Establish which hosts are in scope by checking the installed package on every openSUSE Leap 16.0 system with 'rpm -q unbound' and 'unbound -V', treating any build below Unbound 1.26.1 as unpatched against the nine CVEs covered by openSUSE-SU-2026:22082-1.
- Confirm the update has actually been installed rather than merely offered by running 'zypper patch-info openSUSE-SU-2026:22082-1' on each Leap 16.0 resolver; the important-rated patch continues to report as needed until the unbound package reaches 1.26.1.
- Re-check the managed-keys state file referenced by auto-trust-anchor-file after moving to Unbound 1.26.1, since that release corrects an autotrust state-file line overflow that could bypass the hold-down applied during trust-anchor rollover.
- After upgrading to 1.26.1, adopt the new max-transfer-size and max-transfer-time options for auth-zone and RPZ transfers; they are disabled by default and cap the size and duration of zone transfers that previously had no limit.
- Review any ipsecmod hook scripts before the upgrade, because 1.26.1 now executes them with execv instead of system and requires the script to begin with the '#!/bin/sh' line, otherwise the hook will fail silently after patching.
- Review the num-ports setting in unbound.conf on resolvers still running a pre-1.26.1 build, as large num_ports values trigger the heap out-of-bounds write caused by size_t-to-int truncation in setup_if() and outside_network_create() that 1.26.1 corrects.
