CVE-2026-33278

NameCVE-2026-33278
DescriptionNLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6304-1
Debian Bugs1137187

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
unbound (PTS)bullseye1.13.1-1+deb11u2vulnerable
bullseye (security)1.13.1-1+deb11u7vulnerable
bookworm1.17.1-2+deb12u4vulnerable
bookworm (security)1.17.1-2+deb12u3vulnerable
trixie1.22.0-2+deb13u2vulnerable
trixie (security)1.22.0-2+deb13u3fixed
forky, sid1.25.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
unboundsourcetrixie1.22.0-2+deb13u3DSA-6304-1
unboundsource(unstable)1.25.1-11137187

Notes

https://www.openwall.com/lists/oss-security/2026/05/20/5
https://nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt

Search for package or bug name: Reporting problems