NLnet Labs Unbound CVE-2026-33278

Target must be running NLnet Labs Unbound between 1.19.1 and 1.25.0 inclusive with DNSSEC validation enabled (the default for the validator module) and must be reachable for recursion from a host that can cause it to query an attacker-controlled signed zone - either an open resolver, or any deployment where the attacker can indirectly induce a name lookup (web content, email, internal client compromise). The specific code path requires that a DS sub-query suspend validation due to NSEC3 hash-iteration budget exhaustion, which the attacker controls by crafting the malicious zone's NSEC3 parameters. Limiting factors: resolvers with DNSSEC validation disabled, or resolvers restricted to a small set of trusted authoritative zones, are not exposed; successful arbitrary code execution (versus crash) additionally requires heap-layout control that the advisory does not confirm has been demonstrated.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with High impact across confidentiality, integrity, and availability - including subsequent-system scope - accurately reflects that a remote, unauthenticated adversary who can induce a target Unbound to query an attacker-controlled authoritative zone can reliably trigger the bug. The vector's E:U (exploit maturity: unreported) and the absence of CISA KEV listing or any public PoC reference suggest the issue is currently theoretical-but-credible rather than under active exploitation. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quoted. The U:Red urgency tag set by the reporter and the vendor's own characterization of possible RCE elevate this above a routine DoS issue, though weaponizing a use-after-free in libc-managed memory across the asynchronous Unbound mainloop is non-trivial and most real-world exploitation is likely to manifest as resolver crashes (denial of service) rather than code execution.

An adversary registers or compromises an authoritative DNS zone, signs it with crafted NSEC3 parameters tuned to exhaust the resolver's computational budget, and induces a target Unbound - for example by embedding a unique subdomain in an email link, web resource, or any query that the victim resolver will recursively follow - to query that zone. The resulting DS sub-query suspension triggers the buggy deep copy, and when the validator resumes it dereferences the dangling pointer, crashing the daemon (denial of service for every downstream client) or, with sufficient heap-grooming control over the freed region, potentially executing attacker-supplied code in the Unbound process context. No public proof-of-concept is identified at time of analysis.