Critical 9.1Published May 20, 2026

CVE-2026-33278Possible arbitrary code execution during DNSSEC validation

Updated under an hour ago (Oct 27, 2026, 10:30 PM ET)

Does this affect you?

It affects NLnet Labs Unbound and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for NLnet Labs Unbound

Exploited in the last 30 days

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.

CVSS: 9.1 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Red
Weakness (CWE): CWE-416, CWE-672
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: NLnet Labs
NVD analysis: Modified
Record last updated: Sep 1, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

NLnet Labs Unbound nlnet_labs:unbound (from the name)	from 1.19.1 before 1.25.1	CNA record
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux	from 0:1.24.2-7.el10_2.1 not affected	CISA ADP
Red Hat Red Hat Hardened Images redhat:hummingbird	from 1.25.1-0.1.hum1 not affected	CISA ADP
Red Hat Red Hat OpenShift Container Platform 4 redhat:openshift	4	CISA ADP
nlnetlabs unbound nlnetlabs:unbound	from 1.19.1 before 1.25.1	NVD

References

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt	vendor-advisory, mitigation
https://access.redhat.com/errata/RHSA-2026:19752
https://access.redhat.com/errata/RHSA-2026:23231
https://access.redhat.com/errata/RHSA-2026:24369
https://access.redhat.com/security/cve/CVE-2026-33278
https://bugzilla.redhat.com/show_bug.cgi?id=2479808
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.