CVE-2026-33278 is a critical (CVSS 9.8) use after free in the DNSSEC validator of NLnet Labs Unbound, versions 1.19.1 up to and including 1.25.0. It can cause a crash and possibly remote code execution. Upgrade to Unbound 1.25.1 or apply the vendor patch.
What's affected
Unbound 1.19.1 up to and including 1.25.0. The fixed release is 1.25.1.
The flaw was introduced with the NSEC3 computational budget logic added in 1.19.1, so older releases are not listed. Distribution packages may carry the fix under their own version numbers, so check your vendor's advisory too. The record references Red Hat errata for this CVE.
How to check if you're exposed
Print the version of the resolver:
unbound -V
If you installed from a distribution, query the package manager and read the vendor advisory, since backported fixes may keep an older version string. Also check any appliance or container image that bundles Unbound.
Paste your lockfile into the free in-browser dependency scan to see which versions you resolve, including transitive ones. Gold also lists this CVE on its directory page.
What to do now
- Upgrade to Unbound 1.25.1, or install your distribution's patched package.
- If you build from source, the NLnet Labs notice links patch files for 1.25.0 that you can apply, then rebuild and reinstall.
- Restart the resolver and confirm the new version with
unbound -V. - Put resolvers that validate DNSSEC on your fast patch list, since they query attacker influenced zones by design.
Why it matters
The weakness classes are CWE-416 (use after free) and CWE-672 (operation on a resource after expiration or release). The NLnet Labs notice explains that when DS sub-queries must pause validation because the NSEC3 budget is used up, Unbound deep copies response messages so they survive the teardown of a memory region. A struct assignment bug overwrites the destination pointer with the source pointer.
After the sub-query region is freed, the resumed validator dereferences the dangling pointer. That gives a crash at minimum and possibly code execution. The attacker needs a malicious signed zone and a way to make a vulnerable Unbound query it, which is realistic for a public recursive resolver. The record does not flag this CVE as known exploited.
Quick check
Can I patch without upgrading?
Yes. The NLnet Labs notice links patch files for Unbound 1.25.0 and a minimal variant. Upgrading to 1.25.1 is the simpler path.
Sources
Last reviewed: 19 October 2026.
