Loading story…
NLnet Labs has addressed multiple vulnerabilities in the Unbound DNS resolver, including CVE-2026-33278, a high-severity flaw in the DNSSEC validator that can cause denial of service and potentially remote code execution. The bug affects Unbound versions 1.19.1 through 1.25.0 and stems from a deep-copy error that overwrites a destination pointer, later triggering a dangling-pointer dereference. The issue is tracked under CWE-416 and CWE-672 and carries high potential impact to confidentiality, integrity, and availability.
Exploitation requires an attacker to control a malicious signed DNS zone and induce a vulnerable Unbound instance to query it while a DS sub-query is suspended because of NSEC3 computational budget exhaustion. Belgium's Centre for Cybersecurity warned that the Unbound vulnerabilities could enable denial-of-service and urged organizations to patch immediately. The vendor has fixed the issue in Unbound 1.25.1, making upgrade a priority for operators using affected resolver versions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Belgium's Centre for Cybersecurity issued an advisory warning that NLnet Labs had addressed multiple vulnerabilities in the Unbound DNS resolver and urged immediate patching. The advisory indicates broader official dissemination of the fixes beyond the initial vulnerability disclosure.
CVE-2026-33278 was publicly disclosed as a newly received vulnerability affecting the Unbound DNS resolver. Public details described possible denial of service and potential arbitrary code execution during DNSSEC validation.
NLnet Labs addressed CVE-2026-33278 in Unbound version 1.25.1. The issue affects Unbound versions 1.19.1 through 1.25.0 and requires a malicious signed zone plus a query during DS sub-query suspension triggered by NSEC3 computational budget exhaustion.
The vulnerability later assigned CVE-2026-33278 was introduced in NLnet Labs Unbound version 1.19.1. The flaw stems from a deep-copy bug in the DNSSEC validator that can cause a dangling-pointer dereference, enabling denial of service and potentially remote code execution under specific conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceccb.belgium.be
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NLnet Labs released **Unbound 1.25.2** as a security update to address multiple vulnerabilities in the Unbound DNS resolver, according to an advisory published on the `oss-sec` mailing list. The fixes cover a broad set of issues across high-, medium-, and low-severity CVEs, including denial-of-service conditions affecting **DNS-over-QUIC** and **DNSCrypt**, cache-poisoning risks, memory corruption, buffer overflows, assertion failures, and bugs that could degrade resolver availability. The advisory says several flaws are tied to specific Unbound features and configurations, including `dns-error-reporting`, `response-ip/rpz`, `serve-expired-client-timeout`, `discard-timeout`, and `unwanted-reply-threshold`. NLnet Labs also addressed problems involving `libngtcp2` behavior under DNS-over-QUIC conditions and added hardening related to an earlier fix for **CVE-2026-40622**, making the release a significant security update for operators running exposed or feature-rich Unbound deployments.
Jul 23, 2026
A high-severity vulnerability, CVE-2025-40778, has been identified in BIND 9 DNS resolvers, exposing over 706,000 servers worldwide to cache poisoning attacks. The flaw, which carries a CVSS v3.1 score of 8.6, allows remote, unauthenticated attackers to inject forged DNS records into resolver caches by exploiting BIND's overly permissive acceptance of certain DNS records in responses. This manipulation can redirect internet traffic to malicious sites, facilitate malware distribution, or enable interception of network communications, posing a significant risk to global DNS infrastructure. The Internet Systems Consortium (ISC) has released advisories and patches addressing the vulnerability in multiple supported and preview versions of BIND 9, including versions 9.18.41, 9.20.15, and 9.21.14, as well as corresponding Supported Preview Edition releases. The publication of proof-of-concept exploit code has heightened the urgency for administrators to patch affected systems, particularly those running recursive DNS servers. While no active exploitation has been observed yet, the widespread use of BIND 9 and the critical nature of DNS services make prompt remediation essential to prevent large-scale attacks.
Jun 29, 2026
Internet Systems Consortium disclosed **nine vulnerabilities** in **BIND 9** and released patched versions **9.20.26** and **9.21.24**. The most severe issue, **`CVE-2026-13321`** (CVSS **8.6**), allows a remotely exploitable **DNSSEC validation bypass** by accepting signed **NSEC** records whose `Next Domain Name` points outside the signer’s zone, enabling cross-zone cache poisoning with authenticated denial responses. ISC also disclosed **`CVE-2026-11721`**, a high-severity **cache poisoning** flaw tied to label-count discrepancies in **RRSIG** and wildcard synthesis, and **`CVE-2026-10723`**, which can let attackers forge authenticated **NXDOMAIN** responses for sibling zones through incorrect acceptance of child-zone **NSEC3** records. ISC said no active exploitation was known at disclosure time and reported no workaround for the affected releases. The remaining flaws include several remotely exploitable **denial-of-service** and **resource exhaustion** bugs affecting DNSSEC-validating resolvers and other BIND components. **`CVE-2026-11622`** can drive memory consumption far beyond configured limits during random-subdomain attacks against DNSSEC-signed zones, while **`CVE-2026-11605`** can force excessive CPU use by making BIND validate unnecessary but valid **RRSIG** records. **`CVE-2026-13204`**, **`CVE-2026-12617`**, and **`CVE-2026-10822`** can cause **`named`** to exit unexpectedly under specific malformed or specially ordered DNS responses, and **`CVE-2026-11331`** can bypass wildcard **RPZ CNAME** policies and also trigger a crash with overly long query names. ISC advised users of affected **9.11**, **9.18**, **9.20**, **9.21**, and Supported Preview Edition branches to upgrade to the nearest patched supported release.
Jul 23, 2026