Two critical vulnerabilities were recently discovered in widely used DNS resolver software: Unbound and CoreDNS. The first, CVE-2026-81642 in Unbound, is a heap overflow vulnerability in its DNSSEC validation component. This flaw can be triggered by a specially crafted DNSKEY record with a compression pointer that points to itself. Successful exploitation could lead to remote code execution via attacker-controlled data. The second, CVE-2026-86003 in CoreDNS, concerns its encrypted transport listeners. These listeners accept unauthenticated DNS UPDATE messages, which are correctly rejected by plaintext transports. An attacker could exploit this to potentially take over hostnames under certain conditions, acting as a confused deputy. The author highlights the surprising silence surrounding these vulnerabilities in public discussions. They emphasize the importance of understanding the context and blast radius of these vulnerabilities over solely relying on CVSS scores for prioritization. The delivery mechanism for the Unbound vulnerability involves an attacker controlling a malicious zone and tricking a resolver into querying it. For CoreDNS, the impact depends on the upstream server's trust and the absence of end-to-end TSIG authentication. The author provides practical steps for checking resolver versions and assessing exposure. They recommend patching Unbound to version 1.26.1 or later and CoreDNS to version 1.14.7 or later. A comprehensive inventory of DNS resolvers within an organization is crucial before patching.