Log in Start free

Vulnerability · Published May 20, 2026 · Assigned by NLnet Labs

CVE-2026-33278Possible arbitrary code execution during DNSSEC validation

High 8.1

In plain English

A high-severity use-after-free in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.4%top 27.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10python3-unbound1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:9python3-unbound1.24.2-3.el9_8.1ALSA-2026:24369
AlmaLinux:10unbound1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:9unbound1.24.2-3.el9_8.1ALSA-2026:24369
AlmaLinux:10unbound-anchor1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:10unbound-devel1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:9unbound-devel1.24.2-3.el9_8.1ALSA-2026:24369
AlmaLinux:10unbound-dracut1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:9unbound-dracut1.24.2-3.el9_8.1ALSA-2026:24369
AlmaLinux:10unbound-libs1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:9unbound-libs1.24.2-3.el9_8.1ALSA-2026:24369
AlmaLinux:10unbound-utils1.24.2-7.el10_2.1ALSA-2026:23231
Alpine:v3.22unbound1.25.2-r0ALPINE-CVE-2026-33278
Alpine:v3.23unbound1.25.2-r0ALPINE-CVE-2026-33278
Alpine:v3.24unbound1.25.1-r0ALPINE-CVE-2026-33278
Debian:12unboundno fix listedDEBIAN-CVE-2026-33278
Debian:13unbound1.22.0-2+deb13u3DEBIAN-CVE-2026-33278
Debian:14unbound1.25.1-1DEBIAN-CVE-2026-33278
Rocky Linux:10unbound0:1.24.2-7.el10_2.1RLSA-2026:23231
Rocky Linux:9unbound0:1.24.2-3.el9_8.1RLSA-2026:24369
Ubuntu:24.04:LTSunbound1.19.2-1ubuntu3.8UBUNTU-CVE-2026-33278
Ubuntu:25.10unbound1.22.0-2ubuntu2.3UBUNTU-CVE-2026-33278
Ubuntu:26.04:LTSunbound1.24.2-1ubuntu2.1UBUNTU-CVE-2026-33278

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound 1.19.1 – before 1.25.1

Weakness: CWE-416, CWE-672 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References