- Description
- NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.
- Source
- sep@nlnetlabs.nl
- NVD status
- Analyzed
- Products
- unbound
CVSS 4.0
- Type
- Secondary
- Base score
- 9.1
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red
- Severity
- CRITICAL
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- sep@nlnetlabs.nl
- CWE-416
- Hype score
- Not currently trending
Release 2026-05c is here! https://t.co/pprfCZtu6Q This update fixes CVE-2026-33278 in unbound and bumps Nginx to version 1.30.2. We strongly recommend updating to this version.
@mailcow_email
26 May 2026
467 Impressions
0 Retweets
11 Likes
0 Bookmarks
0 Replies
0 Quotes
Warning: #NLnet Labs has addressed multiple vulnerabilities, #CVE-2026-33278; #CVE-2026-42944; #CVE-2026-42959. Successful exploitation could enable to denial of service #DoS, and potentially remote code execution #RCE! #Patch #Patch #Patch
@CCBalert
21 May 2026
144 Impressions
1 Retweet
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🔐 NLnet Labs released Unbound 1.25.1 with fixes for 11 CVEs — including a use-after-free in the DNSSEC validator (CVE-2026-33278) that could lead to remote code execution, and a cache poisoning flaw (CVE-2026-42960). 🔗 https://t.co/UaH94aLG8Q #CyberSecurity #ThreatIntel
@ThreatAft
21 May 2026
56 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Top 5 Trending CVEs: 1 - CVE-2026-42945 2 - CVE-2026-46333 3 - CVE-2026-0265 4 - CVE-2020-2033 5 - CVE-2026-33278 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W
@CVEShield
21 May 2026
145 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
BREAKING: Ubuntu fixes 5 Unbound flaws including CVE-2026-32792 and CVE-2026-33278 affecting 22.04, 24.04, 25.10, 26.04 LTS with DoS and RCE risk, urges immediate updates. https://t.co/YG4fcAvfhs
@threatcluster
20 May 2026
77 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
【自分用メモ】CVE-2026-33278。UnboundのRCE脆弱性。CVSSスコア9.1。エグい。 https://t.co/JDWh34CDyH CVE Record: CVE-2026-33278 https://t.co/Jj6kKshdSn
@OrangeMorishita
20 May 2026
1820 Impressions
9 Retweets
16 Likes
6 Bookmarks
0 Replies
1 Quote
Unbound 1.25.1 fixes 11 CVEs https://t.co/ifcflXyhiP CVE-2026-33278: Remote code execution during DNSSEC validation CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options CVE-2026-42959: Crash during DNSSEC validation of malicious content +8 more
@oss_security
20 May 2026
1604 Impressions
6 Retweets
17 Likes
5 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C330C7D-8CBA-407E-9C85-8BB7D5A97797",
"versionEndExcluding": "1.25.1",
"versionStartIncluding": "1.19.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]