cve-2026-33278

CVE-2026-33278 is a critical DNSSEC validation flaw in Unbound, affecting versions 1.19.1 through 1.25.0. Disclosed by NLnet Labs on May 20, 2026, the vulnerability can lead to denial of service and potentially remote code execution. The fix is included in Unbound 1.25.1. This tag covers discussions about the bug, its impact on validating recursive resolvers, and the importance of patching. The flaw highlights a dangerous code path in DNSSEC validation, where the validator itself becomes a security risk. Administrators running vulnerable Unbound versions should prioritize updating to 1.25.1 to mitigate the threat.