kritisch
CVE-2026-33278
unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Azure Linux, Photon OS. Niedriger laut Red Hat (hoch), AlmaLinux (hoch), Amazon (hoch), Oracle (hoch), Rocky Linux (hoch), Ubuntu (hoch).
Beschreibung
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Azure Linux 3.0 | unbound | 0:1.25.1-1.azl3 |
| Photon OS 4.0 | unbound, unbound-devel, unbound-docs | 1.25.1-1.ph4 |
| Photon OS 5.0 | unbound, unbound-devel, unbound-docs | 1.25.1-1.ph5 |
| alma 10 | python3-unbound, unbound, unbound-anchor und 4 weitere | 1.24.2-7.el10_2.1 |
| alma 9 | python3-unbound, unbound, unbound-devel und 2 weitere | 1.24.2-3.el9_8.1 |
| alpine 3.22 | unbound | 1.25.2-r0 |
| alpine 3.23 | unbound | 1.25.2-r0 |
| alpine 3.24 | unbound | 1.25.1-r0 |
| alpine edge | unbound | 1.25.1-r0 |
| amazon linux 2 | python2-unbound, python3-unbound, unbound und 3 weitere | 1.7.3-15.amzn2.0.14 |
| amazon linux 2023 | python3-unbound, python3-unbound-debuginfo, unbound und 9 weitere | 1.17.1-1.amzn2023.0.12 |
| debian 11 | unbound | kein Fix angegeben |
Alle 137 Einträge aus 41 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Azure Linux 3.0 | unbound | 0:1.25.1-1.azl3 |
| Photon OS 4.0 | unbound | 1.25.1-1.ph4 |
| Photon OS 4.0 | unbound-devel | 1.25.1-1.ph4 |
| Photon OS 4.0 | unbound-docs | 1.25.1-1.ph4 |
| Photon OS 5.0 | unbound | 1.25.1-1.ph5 |
| Photon OS 5.0 | unbound-devel | 1.25.1-1.ph5 |
| Photon OS 5.0 | unbound-docs | 1.25.1-1.ph5 |
| alma 10 | python3-unbound | 1.24.2-7.el10_2.1 |
| alma 10 | unbound | 1.24.2-7.el10_2.1 |
| alma 10 | unbound-anchor | 1.24.2-7.el10_2.1 |
| alma 10 | unbound-devel | 1.24.2-7.el10_2.1 |
| alma 10 | unbound-dracut | 1.24.2-7.el10_2.1 |
| alma 10 | unbound-libs | 1.24.2-7.el10_2.1 |
| alma 10 | unbound-utils | 1.24.2-7.el10_2.1 |
| alma 9 | python3-unbound | 1.24.2-3.el9_8.1 |
| alma 9 | unbound | 1.24.2-3.el9_8.1 |
| alma 9 | unbound-devel | 1.24.2-3.el9_8.1 |
| alma 9 | unbound-dracut | 1.24.2-3.el9_8.1 |
| alma 9 | unbound-libs | 1.24.2-3.el9_8.1 |
| alpine 3.22 | unbound | 1.25.2-r0 |
| alpine 3.23 | unbound | 1.25.2-r0 |
| alpine 3.24 | unbound | 1.25.1-r0 |
| alpine edge | unbound | 1.25.1-r0 |
| amazon linux 2 | python2-unbound | 1.7.3-15.amzn2.0.14 |
| amazon linux 2 | python3-unbound | 1.7.3-15.amzn2.0.14 |
| amazon linux 2 | unbound | 1.7.3-15.amzn2.0.14 |
| amazon linux 2 | unbound-debuginfo | 1.7.3-15.amzn2.0.14 |
| amazon linux 2 | unbound-devel | 1.7.3-15.amzn2.0.14 |
| amazon linux 2 | unbound-libs | 1.7.3-15.amzn2.0.14 |
| amazon linux 2023 | python3-unbound | 1.17.1-1.amzn2023.0.12 |
| amazon linux 2023 | python3-unbound-debuginfo | 1.17.1-1.amzn2023.0.12 |
| amazon linux 2023 | unbound | 1.17.1-1.amzn2023.0.12 |
| amazon linux 2023 | unbound-anchor | 1.17.1-1.amzn2023.0.12 |
| amazon linux 2023 | unbound-anchor-debuginfo | 1.17.1-1.amzn2023.0.12 |
| amazon linux 2023 | unbound-debuginfo | 1.17.1-1.amzn2023.0.12 |
| amazon linux 2023 | unbound-debugsource | 1.17.1-1.amzn2023.0.12 |
| amazon linux 2023 | unbound-devel | 1.17.1-1.amzn2023.0.12 |
| amazon linux 2023 | unbound-libs | 1.17.1-1.amzn2023.0.12 |
| amazon linux 2023 | unbound-libs-debuginfo | 1.17.1-1.amzn2023.0.12 |
| amazon linux 2023 | unbound-utils | 1.17.1-1.amzn2023.0.12 |
| amazon linux 2023 | unbound-utils-debuginfo | 1.17.1-1.amzn2023.0.12 |
| debian 11 | unbound | kein Fix angegeben |
| debian 12 | unbound | kein Fix angegeben |
| debian 13 | unbound | 1.22.0-2+deb13u3 |
| debian 14 | unbound | 1.25.1-1 |
| echo | unbound | 1.22.0-2+deb13u3 |
| Oracle Linux 9 | python3-unbound | 1.24.2-3.el9_8.1 |
| Oracle Linux 9 | unbound | 1.24.2-3.el9_8.1 |
| Oracle Linux 9 | unbound-devel | 1.24.2-3.el9_8.1 |
| Oracle Linux 9 | unbound-dracut | 1.24.2-3.el9_8.1 |
| Oracle Linux 9 | unbound-libs | 1.24.2-3.el9_8.1 |
| rapidfort alma 10 | python3-unbound | 1.24.2-7.el10_2.1 |
| rapidfort alma 10 | unbound | 0:1.24.2-7.el10_2.1 |
| rapidfort alma 10 | unbound-anchor | 0:1.24.2-7.el10_2.1 |
| rapidfort alma 10 | unbound-devel | 1.24.2-7.el10_2.1 |
| rapidfort alma 10 | unbound-dracut | 1.24.2-7.el10_2.1 |
| rapidfort alma 10 | unbound-libs | 0:1.24.2-7.el10_2.1 |
| rapidfort alma 10 | unbound-utils | 1.24.2-7.el10_2.1 |
| rapidfort alma 9 | python3-unbound | 1.24.2-3.el9_8.1 |
| rapidfort alma 9 | unbound | 0:1.24.2-3.el9_8.1 |
| rapidfort alma 9 | unbound-dracut | 1.24.2-3.el9_8.1 |
| rapidfort alma 9 | unbound-libs | 0:1.24.2-3.el9_8.1 |
| rapidfort alpine 3.20 | unbound | 1.25.1-r0 |
| rapidfort alpine 3.21 | unbound | 1.25.1-r0 |
| rapidfort alpine 3.22 | unbound | 1.25.1-r0 |
| rapidfort alpine 3.23 | unbound | 1.25.1-r0 |
| rapidfort amazon linux 2023 | python3-unbound | 1.17.1-1.amzn2023.0.12 |
| rapidfort amazon linux 2023 | unbound | 0:1.17.1-1.amzn2023.0.12 |
| rapidfort amazon linux 2023 | unbound-anchor | 0:1.17.1-1.amzn2023.0.12 |
| rapidfort amazon linux 2023 | unbound-devel | 1.17.1-1.amzn2023.0.12 |
| rapidfort amazon linux 2023 | unbound-libs | 0:1.17.1-1.amzn2023.0.12 |
| rapidfort amazon linux 2023 | unbound-utils | 1.17.1-1.amzn2023.0.12 |
| rapidfort debian 12 | rf-unbound | 0:1.26.0-1 |
| rapidfort debian 12 | unbound | 0:1.22.0-2+deb13u3, 0:1.25.1-1 |
| rapidfort debian 13 | rf-unbound | 0:1.26.0-1 |
| rapidfort debian 13 | unbound | 0:1.22.0-2+deb13u3, 0:1.25.1-1 |
| rapidfort fedora 41 | rf-unbound | 0:1.24.1-2.fc41 |
| rapidfort fedora 41 | rf-unbound-anchor | 0:1.24.1-2.fc41 |
| rapidfort fedora 41 | rf-unbound-libs | 0:1.24.1-2.fc41 |
| rapidfort fedora 41 | unbound | 0:1.24.1-2.fc41 |
| rapidfort fedora 41 | unbound-anchor | 0:1.24.1-2.fc41 |
| rapidfort fedora 41 | unbound-libs | 0:1.24.1-2.fc41 |
| rapidfort fedora 43 | python3-unbound | 1.25.1-1.fc43 |
| rapidfort fedora 43 | rf-unbound | 0:1.25.1-1.fc43 |
| rapidfort fedora 43 | rf-unbound-anchor | 0:1.25.1-1.fc43 |
| rapidfort fedora 43 | rf-unbound-libs | 0:1.25.1-1.fc43 |
| rapidfort fedora 43 | unbound | 0:1.25.1-1.fc43 |
| rapidfort fedora 43 | unbound-anchor | 0:1.25.1-1.fc43 |
| rapidfort fedora 43 | unbound-devel | 1.25.1-1.fc43 |
| rapidfort fedora 43 | unbound-dracut | 1.25.1-1.fc43 |
| rapidfort fedora 43 | unbound-libs | 0:1.25.1-1.fc43 |
| rapidfort fedora 43 | unbound-munin | 1.25.1-1.fc43 |
| rapidfort fedora 43 | unbound-utils | 1.25.1-1.fc43 |
| rapidfort Oracle Linux 10 | python3-unbound | 0:1.24.2-7.el10_2.2 |
| rapidfort Oracle Linux 10 | unbound | 0:1.24.2-7.el10_2.2 |
| rapidfort Oracle Linux 10 | unbound-anchor | 0:1.24.2-7.el10_2.2 |
| rapidfort Oracle Linux 10 | unbound-devel | 0:1.24.2-7.el10_2.2 |
| rapidfort Oracle Linux 10 | unbound-dracut | 0:1.24.2-7.el10_2.2 |
| rapidfort Oracle Linux 10 | unbound-libs | 0:1.24.2-7.el10_2.2 |
| rapidfort Oracle Linux 10 | unbound-utils | 0:1.24.2-7.el10_2.2 |
| rapidfort Oracle Linux 9 | python3-unbound | 0:1.24.2-3.el9_8.1 |
| rapidfort Oracle Linux 9 | unbound | 0:1.24.2-3.el9_8.1 |
| rapidfort Oracle Linux 9 | unbound-devel | 0:1.24.2-3.el9_8.1 |
| rapidfort Oracle Linux 9 | unbound-dracut | 0:1.24.2-3.el9_8.1 |
| rapidfort Oracle Linux 9 | unbound-libs | 0:1.24.2-3.el9_8.1 |
| rapidfort rocky 9 | python3-unbound | 0:1.24.2-3.el9_8.1 |
| rapidfort rocky 9 | rf-unbound | 0:1.24.2-3.el9_8.1 |
| rapidfort rocky 9 | rf-unbound-libs | 0:1.24.2-3.el9_8.1 |
| rapidfort rocky 9 | unbound | 0:1.24.2-3.el9_8.1 |
| rapidfort rocky 9 | unbound-dracut | 0:1.24.2-3.el9_8.1 |
| rapidfort rocky 9 | unbound-libs | 0:1.24.2-3.el9_8.1 |
| rapidfort ubuntu 20.04 | rf-unbound | 0:1.13.1-1ubuntu5.14, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1 |
| rapidfort ubuntu 20.04 | unbound | 0:1.13.1-1ubuntu5.14, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1 |
| rapidfort ubuntu 22.04 | rf-unbound | 0:1.13.1-1ubuntu5.14, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1 |
| rapidfort ubuntu 22.04 | unbound | 0:1.13.1-1ubuntu5.14, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1 |
| rapidfort ubuntu 24.04 | rf-unbound | 0:1.13.1-1ubuntu5.14, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1 |
| rapidfort ubuntu 24.04 | unbound | 0:1.13.1-1ubuntu5.14, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1 |
| Red Hat | openshift/ose-rhel-coreos-9 | kein Fix angegeben |
| Red Hat | unbound | kein Fix angegeben |
| Red Hat | unbound-devel | kein Fix angegeben |
| Red Hat | unbound-libs | kein Fix angegeben |
| Red Hat | unbound-python | kein Fix angegeben |
| rocky 10 | python3-unbound | 1.24.2-7.el10_2.1 |
| rocky 10 | unbound | 1.24.2-7.el10_2.1 |
| rocky 10 | unbound-anchor | 1.24.2-7.el10_2.1 |
| rocky 10 | unbound-dracut | 1.24.2-7.el10_2.1 |
| rocky 10 | unbound-libs | 1.24.2-7.el10_2.1 |
| rocky 10 | unbound-utils | 1.24.2-7.el10_2.1 |
| rocky 9 | python3-unbound | 1.24.2-3.el9_8.1 |
| rocky 9 | unbound | 1.24.2-3.el9_8.1 |
| rocky 9 | unbound-dracut | 1.24.2-3.el9_8.1 |
| rocky 9 | unbound-libs | 1.24.2-3.el9_8.1 |
| seal Red Hat 8 | seal-unbound | 1.16.2-5.8.el8_10+sp2 |
| seal Red Hat 8 | unbound | 1.16.2-5.8.el8_10+sp2 |
| ubuntu 24.04 | unbound | 1.19.2-1ubuntu3.8 |
| ubuntu 25.10 | unbound | 1.22.0-2ubuntu2.3 |
| ubuntu 26.04 | unbound | 1.24.2-1ubuntu2.1 |
Referenzen
- https://access.redhat.com/errata/RHSA-2026:19752
- https://access.redhat.com/errata/RHSA-2026:23231
- https://access.redhat.com/errata/RHSA-2026:24369
- https://access.redhat.com/security/cve/CVE-2026-33278
- https://bugzilla.redhat.com/2479774
- https://bugzilla.redhat.com/2479806
- https://bugzilla.redhat.com/2479808
- https://bugzilla.redhat.com/show_bug.cgi?id=2479774
Alle 24 Referenzen
- https://bugzilla.redhat.com/show_bug.cgi?id=2479806
- https://bugzilla.redhat.com/show_bug.cgi?id=2479808
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33278
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42944
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42959
- https://errata.almalinux.org/9/ALSA-2026-24369.html
- https://errata.rockylinux.org/RLSA-2026:24369
- https://linux.oracle.com/cve/CVE-2026-33278.html
- https://linux.oracle.com/errata/ELSA-2026-24369.html
- https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/
- https://nvd.nist.gov/vuln/detail/CVE-2026-33278
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json
- https://ubuntu.com/security/notices/USN-8282-1
- https://www.cve.org/CVERecord?id=CVE-2026-33278
- https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt