Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1690

NIXPKGS-2026-1690
published on
Permalink CVE-2026-33278
9.1 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): High (H)
  • Subsequent System Impact Availability (SA): High (H)
  • Exploit Maturity (E): Unreported (U)
  • Provider Urgency (U): Red (Red)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): High (H)
  • Modified Subsequent System Impact Availability (MSA): High (H)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
updated 2 days, 12 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 17 hours ago
  • @LeSuisse ignored
    16 packages
    • luaPackages.luaunbound
    • lua51Packages.luaunbound
    • lua52Packages.luaunbound
    • lua53Packages.luaunbound
    • lua54Packages.luaunbound
    • lua55Packages.luaunbound
    • luajitPackages.luaunbound
    • prometheus-unbound-exporter
    • python312Packages.pyunbound
    • python313Packages.pyunbound
    • python314Packages.pyunbound
    • unbound-with-systemd
    • haskellPackages.unbound-generics-unify
    • haskellPackages.unbound-kind-generics
    • haskellPackages.unbounded-delays
    • haskellPackages.unbound-generics
    2 days, 12 hours ago
  • @LeSuisse ignored maintainer @Scrumplex 2 days, 12 hours ago maintainer.ignore
  • @LeSuisse restored package unbound-with-systemd 2 days, 12 hours ago
  • @LeSuisse accepted 2 days, 12 hours ago
  • @LeSuisse published on GitHub 2 days, 12 hours ago
Possible arbitrary code execution during DNSSEC validation

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.

Affected products

Unbound
  • <1.25.1

Matching in nixpkgs

Ignored packages (15)

Package maintainers

Ignored maintainers (1)