Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-33278: Unbound DNS resolver may crash or be hijacked
CVE-2026-33278 · published 4 months ago
Summary
Versions of Unbound from 1.19.1 through 1.25.0 can be forced to stop working or potentially run malicious code when they process specially crafted DNS data. The problem occurs during DNSSEC validation, a security feature that checks the authenticity of DNS responses. Updating Unbound to version 1.25.1 or later resolves the issue.
What to do
- Update canonical unbound to version 1.19.2-1ubuntu3.8.
- Update canonical unbound to version 1.22.0-2ubuntu2.3.
- Update canonical unbound to version 1.24.2-1ubuntu2.1.
- Update debian unbound to version 1.25.1-1.
- Update debian rootio-unbound to version 1.17.1-2+deb12u3.root.io.1.
- Update debian unbound to version 1.17.1-2+deb12u4.aikido.2.
- Update debian unbound to version 1.13.1-1+deb11u7.aikido.1.
- Update debian rootio-unbound to version 1.13.1-1+deb11u7.aikido.1.
- Update debian unbound to version 1.13.1-1+deb11u7.aikido.3.
- Update debian rootio-unbound to version 1.13.1-1+deb11u7.aikido.3.
- Update debian unbound to version 1.13.1-1+deb11u7.aikido.6.
- Update debian rootio-unbound to version 1.13.1-1+deb11u7.aikido.6.
- Update debian rootio-unbound to version 1.17.1-2+deb12u4.aikido.2.
- Update debian unbound to version 1.17.1-2+deb12u4.aikido.3.
- Update debian rootio-unbound to version 1.17.1-2+deb12u4.aikido.3.
- Update debian unbound to version 1.17.1-2+deb12u4.aikido.4.
- Update debian rootio-unbound to version 1.17.1-2+deb12u4.aikido.4.
- Update unbound to version 1.17.1-2+deb12u4.aikido.5.
- Update rootio-unbound to version 1.17.1-2+deb12u4.aikido.5.
- Update unbound to version 1.25.2-r0.
- Update unbound to version 1.25.1-r0.
- Update nlnetlabs unbound to version 1.25.1 or later.
- Update nlnet labs unbound to version 1.25.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:24.04:LTS | canonical | unbound |
< 1.19.2-1ubuntu3.8 Fix: upgrade to 1.19.2-1ubuntu3.8
|
| Ubuntu:25.10 | canonical | unbound |
< 1.22.0-2ubuntu2.3 Fix: upgrade to 1.22.0-2ubuntu2.3
|
| Ubuntu:26.04:LTS | canonical | unbound |
< 1.24.2-1ubuntu2.1 Fix: upgrade to 1.24.2-1ubuntu2.1
|
| – | nlnetlabs | unbound |
>= 1.19.1, < 1.25.1 cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:* |
| Debian:11 | debian | unbound | All versions |
| Debian:12 | debian | unbound | All versions |
| Debian:13 | debian | unbound | All versions |
| Debian:14 | debian | unbound |
< 1.25.1-1 Fix: upgrade to 1.25.1-1
|
| Root:Debian:12 | debian | rootio-unbound |
< 1.17.1-2+deb12u3.root.io.1 < 1.17.1-2+deb12u4.aikido.2 < 1.17.1-2+deb12u4.aikido.3 < 1.17.1-2+deb12u4.aikido.4 Fix: upgrade to 1.17.1-2+deb12u3.root.io.1
|
| Root:Debian:12 | debian | unbound |
< 1.17.1-2+deb12u4.aikido.2 < 1.17.1-2+deb12u4.aikido.3 < 1.17.1-2+deb12u4.aikido.4 Fix: upgrade to 1.17.1-2+deb12u4.aikido.2
|
| – | nlnet labs | unbound | < 1.25.1 |
| Root:Debian:11 | debian | unbound |
< 1.13.1-1+deb11u7.aikido.1 < 1.13.1-1+deb11u7.aikido.3 < 1.13.1-1+deb11u7.aikido.6 Fix: upgrade to 1.13.1-1+deb11u7.aikido.1
|
| Root:Debian:11 | debian | rootio-unbound |
< 1.13.1-1+deb11u7.aikido.1 < 1.13.1-1+deb11u7.aikido.3 < 1.13.1-1+deb11u7.aikido.6 Fix: upgrade to 1.13.1-1+deb11u7.aikido.1
|
| Root:Debian:12 | – | unbound |
< 1.17.1-2+deb12u4.aikido.5 Fix: upgrade to 1.17.1-2+deb12u4.aikido.5
|
| Root:Debian:12 | – | rootio-unbound |
< 1.17.1-2+deb12u4.aikido.5 Fix: upgrade to 1.17.1-2+deb12u4.aikido.5
|
| Alpine:v3.23 | – | unbound |
>= 1.19.1, < 1.25.2-r0 Fix: upgrade to 1.25.2-r0
|
| Alpine:v3.24 | – | unbound |
>= 1.19.1, < 1.25.1-r0 Fix: upgrade to 1.25.1-r0
|
Original advisory text
CVE-2026-33278 in unbound - Patched by Root
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.
References
- https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt Mitigation Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-33278 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2479808
- https://access.redhat.com/errata/RHSA-2026:19752
- https://access.redhat.com/errata/RHSA-2026:23231
- https://access.redhat.com/errata/RHSA-2026:24369
- https://access.redhat.com/security/cve/CVE-2026-33278
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json
- https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/ Third Party Advisory
- https://ubuntu.com/security/CVE-2026-33278 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-33278 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8282-1 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-33278 Vendor Advisory
Severity
9.1
Critical
CVSS 4.0: 9.1 (NVD)
CVSS 3.1: 9.8 (OSV)
CVSS 4.0: 9.9 (OSV)
Exploitation
EPSS 1%
Type
CWE-416Use After Free
CWE-672Operation on a Resource after Expiration or Release
Timeline
Published20 May 2026
Updated25 Sep 2026
First seen20 May 2026
Sources
CVE-2026-33278 · NVD
CVE-2026-33278 · MITRE
UBUNTU-CVE-2026-33278 · OSV
DEBIAN-CVE-2026-33278 · OSV
ALPINE-CVE-2026-33278 · OSV
Track software like this
Free during beta