{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2026/cve-2026-33278-els_os-oraclelinux6els.json" } ], "tracking": { "current_release_date": "2026-10-28T11:32:52Z", "generator": { "date": "2026-10-28T11:32:52Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-33278-ELS_OS-ORACLELINUX6ELS", "initial_release_date": "2026-05-20T10:16:00Z", "revision_history": [ { "date": "2026-05-20T10:16:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-28T11:32:52Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-33278" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 6", "product": { "name": "Oracle Linux 6", "product_id": "Oracle-Linux-6", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-libs@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-devel@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-python@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-libs@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-devel@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-python@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "Oracle-Linux-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-33278", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.", "title": "Vulnerability description" }, { "category": "other", "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.", "title": "Statement" } ], "product_status": { "known_not_affected": [ "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-33278" }, { "category": "external", "summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt", "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19752", "url": "https://access.redhat.com/errata/RHSA-2026:19752" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:23231", "url": "https://access.redhat.com/errata/RHSA-2026:23231" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:24369", "url": "https://access.redhat.com/errata/RHSA-2026:24369" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-33278", "url": "https://access.redhat.com/security/cve/CVE-2026-33278" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2479808", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479808" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json" } ], "release_date": "2026-05-20T10:16:00Z", "threats": [ { "category": "impact", "details": "Critical" }, { "category": "impact", "date": "2026-10-15T12:50:04.689805Z", "details": "critical", "product_ids": [ "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" ] } ] } ] }