Signal is active with 1 mentions in latest observed window
Immediate actions
Patch nlnetlabs unbound systems immediately
Recommended action window: Monitor and triage in normal cycle
NVD description
NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.
Unbound 1.25.1 fixes 11 CVEs https://www.openwall.com/lists/oss-security/2026/05/20/5
CVE-2026-33278: Remote code execution during DNSSEC validation
CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options
CVE-2026-42959: Crash during DNSSEC validation of malicious content
+8 more
Post summary
The advisory announces that Unbound 1.25.1 patches 11 CVEs, including RCE and heap overflow vulnerabilities, and provides the advisory link, but does not include PoC, exploit code, or evidence of active exploitation.
・Fix CVE-2026-33278, Possible remote code execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-42944, Heap overflow and crash with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-42959, Crash during DNSSEC validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-32792, Packet of death with DNSCrypt. Thanks to Andrew Griffiths from ‘http://calif.io’ for the report.
・Fix CVE-2026-40622, “Ghost domain name” variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-41292, Parsing a long list of incoming EDNS options degrades performance. Thanks to GitHub user ‘N0zoM1z0’, also Qifan Zhang from Palo Alto Networks, for the report.
・Fix CVE-2026-42534, Jostle logic bypass degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-42923, Degradation of service with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-42960, Possible cache poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and JianJun Chen, Tsinghua University, for the report.
・Fix CVE-2026-44390, Unbounded name compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
・Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Post summary
The text lists fixes for several DNS‑related CVEs, highlighting vulnerability types but offering no PoC, exploit code, or active exploitation claims.
Warning: #NLnet Labs has addressed multiple vulnerabilities, #CVE-2026-33278; #CVE-2026-42944; #CVE-2026-42959. Successful exploitation could enable to denial of service #DoS, and potentially remote code execution #RCE! #Patch#Patch#Patch
Post summary
NLnet Labs has released patches for CVE-2026-33278, CVE-2026-42944, and CVE-2026-42959, noting that successful exploitation could lead to DoS or potentially RCE, but no evidence of active attacks is presented.
"This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42960, CVE-2026-44390 and CVE-2026-44608."
Post summary
This release note announces that multiple CVE vulnerabilities have been addressed through software fixes.
