CVE-2026-33261: Null pointer accces in aggressive NSEC(3) cache
Published Apr 22, 2026
·Updated
A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.
Affected Software
6 affected componentsFixes available
Nlnet Labs Unbound
PowerDNS recursor>=5.2.0<5.2.9
PowerDNS recursor>=5.3.0<5.3.6
PowerDNS recursor=5.4.0
alpine/pdns-recursor<5.3.6-r0
5.3.6-r0
alpine/pdns-recursor<5.4.1-r0
5.4.1-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/pdns-recursorto a version that resolves this vulnerability.Fixed in 5.3.6-r0 - Upgrade
Upgrade
alpine/pdns-recursorto a version that resolves this vulnerability.Fixed in 5.4.1-r0
Event History
Apr 22, 2026
CVE Published
via MITRE·09:40 AM
Data Sourced
via MITRE·09:40 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·10:16 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-33261?
CVE-2026-33261 is classified as a denial of service vulnerability.
2
How do I fix CVE-2026-33261?
To fix CVE-2026-33261, update to the latest version of NLnet Labs Unbound that addresses the vulnerability.
3
What software is affected by CVE-2026-33261?
CVE-2026-33261 affects the NLnet Labs Unbound software.
4
Can CVE-2026-33261 cause data loss?
CVE-2026-33261 may cause denial of service, but it does not directly lead to data loss.
5
Is there a workaround for CVE-2026-33261?
Currently, the recommended action for CVE-2026-33261 is to apply the security update provided by NLnet Labs.