CVE-2026-81642 — Unbound DNSKEY digest heap overflow tracking site

Source for the CVE-2026-81642 patch-status tracker: a single-page site recording which distributions have shipped a fix for the Unbound DNSSEC validator heap overflows and the ReTrap complexity attacks disclosed alongside them.

Where the facts live

Everything about the bugs — affected and fixed versions, the upstream advisories, discovery and disclosure credit, and current per-distribution patch status — belongs to the tracker page, not to this README:

• Rendered: https://kimmo.cloud/CVE-2026-81642/
• Source: site/content/_index.md

Edit that file; everything else in this repo is build infrastructure.

None of it is restated here on purpose. The tracker page is revised as distributions ship fixes — for the actively updated trackers, twice daily by the auto-update agent — so any copy kept in this README would silently rot. Resist re-adding a summary.

Deployment plan and current setup state live in WEBSITE.md.

Local development

Requires Hugo ≥ 0.146.0 (the standard edition suffices: no Sass or image processing in this site) and Go (for Hugo Modules to fetch the PaperMod theme).

With Nix (recommended)

nix develop          # dev shell: hugo, go, resvg + fonts, and every lookup tool
cd site
hugo server          # local preview at http://localhost:1313/CVE-2026-81642/

If you use direnv, direnv allow once and the dev shell auto-activates whenever you cd into the repo.

Without Nix

Install Hugo ≥ 0.146.0 and Go ≥ 1.24 yourself (CLAUDE.md § "Build environment" has the go install recipe), then:

cd site
hugo server          # http://localhost:1313/CVE-2026-81642/

Build and publish

make build       # local build into site/public/
make dist        # build, then rsync to haig:/CVE-2026-81642/
make banner      # re-rasterise the social banner SVG → PNG (needs resvg + the banner fonts)

make dist runs make build first. make banner is only needed after editing site/assets/cve-2026-81642-tracker.svg; the rendered PNG is committed.

Dating a fix

A row's Fixed since is the date the fix actually shipped, derived from the source that shipped it — never the day it was noticed. For the NixOS and nixpkgs channels that derivation is a script:

./scripts/nixos-first-shipped nixos-unstable <nixpkgs-commit>

It lists the channel's published releases, finds the earliest one built from a revision containing the commit, and prints that release and its publication date. Debian dates come from the changelog or snapshot.debian.org, pkgsrc dates from the package Makefile's history.

Three more helpers read the current state — two out of the local clones, one from Debian's servers:

./scripts/nixpkgs-versions

./scripts/pkgsrc-versions

./scripts/debian-versions

Each prints one tab-separated line per tracked row — the version, and which of the ids in scripts/tracked-ids a patch, expression, or changelog names. They fail loudly rather than print a wrong row. pkgsrc-versions reports a quarterly branch the clone does not have yet as absent, so a row can be seeded ahead of the branch. make check runs their tests.

Repo layout

.
├── flake.nix              # Nix dev environment (build, banner, publish, lookup tools)
├── .envrc                 # direnv hook → `use flake`
├── .gitignore
├── Makefile               # `make build`, `make dist`, `make banner`, `make check`
├── LICENSE                # CC BY 4.0
├── README.md              # this file
├── CLAUDE.md              # project instructions for Claude Code
├── WEBSITE.md             # publication plan / decisions log
├── scripts/               # auto-update driver + prompt, and the lookup helpers
├── systemd/               # user-level timer + service units
├── tests/                 # tests for the lookup helpers (and the unused alas-cve)
└── site/                  # Hugo project
    ├── hugo.toml
    ├── content/
    │   └── _index.md      # the tracker (single page)
    ├── assets/css/extended/custom.css      # PaperMod CSS overrides
    ├── assets/cve-2026-81642-tracker.svg   # social-banner source (→ make banner)
    ├── static/cve-2026-81642-tracker.png   # rendered OpenGraph banner (committed)
    ├── layouts/partials/  # PaperMod overrides (post_meta, extend_footer)
    ├── layouts/shortcodes/details.html     # collapsible verification log
    ├── go.mod, go.sum     # Hugo Modules — pulls PaperMod theme
    └── …                  # standard Hugo skeleton

License

CC BY 4.0 — share and adapt with attribution.