Threats Tagged 'cve-2026-33278'

This update for unbound fixes the following issues - CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583). - CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587). - CVE-2026-40622: "Ghost domain name" variant (bsc#1265581). - CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580). - CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585). - CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589). - CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578). - CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586). - CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588). - CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584). - CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).

This update includes the following RPMs: unbound: * python3-unbound-1.25.1-0.1.hum1 (aarch64, x86_64) * unbound-1.25.1-0.1.hum1 (aarch64, x86_64) * unbound-anchor-1.25.1-0.1.hum1 (aarch64, x86_64) * unbound-devel-1.25.1-0.1.hum1 (aarch64, x86_64) * unbound-dracut-1.25.1-0.1.hum1 (aarch64, x86_64) * unbound-libs-1.25.1-0.1.hum1 (aarch64, x86_64) * unbound-munin-1.25.1-0.1.hum1 (noarch) * unbound-utils-1.25.1-0.1.hum1 (aarch64, x86_64) * unbound-1.25.1-0.1.hum1.src (src)

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.