CVE-2026-33278 Possible arbitrary code execution during DNSSEC validation
Remote attackers can cause denial of service or execute arbitrary code in Unbound by exploiting a use-after-free bug in DNSSEC validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33278?
CVE-2026-33278 is a critical use after free vulnerability in Nlnetlabs Unbound, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.
Which versions are affected by CVE-2026-33278?
It affects 1 product.
Products include Nlnetlabs Unbound.
How do I fix CVE-2026-33278?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-33278 being exploited?
There is no known exploitation of CVE-2026-33278 in the wild and no public exploit code.
Other vulnerabilities in Nlnetlabs Unbound
- CVE-2026-81642 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
- CVE-2026-42944 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
- CVE-2026-42959 Crash during DNSSEC validation of malicious content
- CVE-2026-82717 CNAME synthesis could lead to heap corruption
- CVE-2026-81634 Possible heap buffer overflow during DNSSEC canonicalization
Sources
Also known as ALPINE-CVE-2026-33278, AZL-87027, CLSA-2026-1779467038, CLSA-2026-1779467345, CLSA-2026-1779467733, CLSA-2026-1779534149 and 7 more.