CVE-2026-33278
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
NLnet Labs Unbound from version 1.19.1 to 1.25.0 has a vulnerability in the DNSSEC validator due to a struct-assignment bug during deep copy, leading to a dangling pointer and potential code execution.
Risk Assessment
An attacker controlling a malicious signed zone can cause denial of service or remote code execution on the Unbound server.
Recommendation
Upgrade Unbound to version 1.25.1, which contains the fix.
Original NVD description (English source)
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.