CRITICAL🇵🇱 Wersja polska

CVE-2026-33278

CVSS 9.1v4.0pub. 2026-05-20upd. 2026-08-25

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

When DS queries require validation suspension due to NSEC3 computational budget exhaustion, Unbound performs a deep copy of response messages to preserve them before memory region deallocation. A bug in structure assignment (struct-assignment bug) causes the target pointer to be overwritten with the pointer from the source. After the sub-query memory region is freed, the resumed validator dereferences this dangling pointer, which results in process crash or potentially allows arbitrary code execution. An attacker can trigger this bug by controlling a malicious signed DNS zone and directing queries to the vulnerable Unbound server.

Impact

An attacker can cause a crash of the DNS name resolution server, causing a denial of service, or — under favorable conditions — execute arbitrary code remotely (RCE) in the context of the Unbound process. The vulnerability affects both the system itself and systems for which Unbound acts as a resolver.

Mitigation & patch

Unbound should be updated to version 1.25.1, which contains a fix that maintains the correct pointer during deep copying of data structures. Details are available in the vendor advisory: https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt

Who is affected

NLnet Labs Unbound in versions from 1.19.1 to 1.25.0 inclusive.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red