CVE-2026-33261: Null pointer accces in aggressive NSEC(3) cache
Published Apr 22, 2026
·Updated
A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.
Affected Software
4 affected components
Nlnet Labs Unbound
PowerDNS recursor>=5.2.0<5.2.9
PowerDNS recursor>=5.3.0<5.3.6
PowerDNS recursor=5.4.0
Event History
Apr 22, 2026
CVE Published
via MITRE·09:40 AM
Data Sourced
via MITRE·09:40 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-33261?
CVE-2026-33261 is classified as a denial of service vulnerability.
2
How do I fix CVE-2026-33261?
To fix CVE-2026-33261, update to the latest version of NLnet Labs Unbound that addresses the vulnerability.
3
What software is affected by CVE-2026-33261?
CVE-2026-33261 affects the NLnet Labs Unbound software.
4
Can CVE-2026-33261 cause data loss?
CVE-2026-33261 may cause denial of service, but it does not directly lead to data loss.
5
Is there a workaround for CVE-2026-33261?
Currently, the recommended action for CVE-2026-33261 is to apply the security update provided by NLnet Labs.