CVE-2026-50243
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Unbound from 1.6.2 up to 1.25.1, when configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. An attacker can exploit this by spoofing BOGUS A/AAAA answers.
Risk Assessment
The vulnerability allows an attacker to bypass DNSSEC validation and redirect clients to malicious IP addresses, potentially leading to traffic interception or man-in-the-middle attacks.
Recommendation
Update Unbound to a version above 1.25.1 that includes the fix. As a temporary measure, consider disabling the 'respip' module or 'response-ip' rules.
Other vulnerabilities in Unbound
See all- CVE-2026-81642Critical
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability in the DNSSEC validator enables denial of service and possible remote code execution via DNSKEY processing. A crafted DNSKEY can overflow the digest buffer.
- CVE-2026-50252Critical
In Unbound library versions 1.4.22 through 1.25.1, a vulnerability allows DNS cache poisoning attacks. The issue arises from deterministic assignment of UDP port ranges to worker threads when SO_REUSEPORT is enabled, enabling an attacker to predict the source port and reduce DNS transaction entropy.
- CVE-2026-42960Critical
NLnet Labs Unbound up to version 1.25.0 is vulnerable to cache poisoning via promiscuous records in the authority section. An attacker can inject non-NS records (e.g., MX) along with address records that Unbound caches, leading to cache poisoning. Version 1.25.1 includes a fix that disregards address records from the additional section if they are not explicitly relevant to NS records.
- CVE-2026-33278Critical
NLnet Labs Unbound from version 1.19.1 to 1.25.0 has a vulnerability in the DNSSEC validator due to a struct-assignment bug during deep copy, leading to a dangling pointer and potential code execution.
- CVE-2026-85501Medium
NLnet Labs Unbound up to and including 1.26.0 is vulnerable to algorithmic complexity attacks (known as 'ReTrap') that cause service degradation. Attacks include TagTrap (large number of mismatched DNSKEY, RRSIG, DS records), DelegationTrap (costly iterative validation for deeply nested domains), NsecTrap (excessive invalid NSEC records), and AdditionalTrap (default validation of ADDITIONAL section).
- CVE-2026-82720Medium
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPS support with '--with-libnghttp2'. During failure code paths (e.g., RPZ drop, jostle), a dropped DoH stream brings down the whole DoH session and does not account properly for other streams, leading to use-after-free. An attacker can trigger it with a single DoH connection, but impact is limited as reads are not user controlled; however, a hardened allocator can catch the use-after-free and controllably terminate the process, causing DoS.
- CVE-2026-80225Medium
In NLnet Labs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
- CVE-2026-78227Medium
NLnet Labs Unbound 1.22.0 up to and including 1.26.1 has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer holding the DNS response, and ngtcp2's retransmission buffer keeps a shallow pointer into it. On client RESET_STREAM, the output buffer is freed but ngtcp2 still holds matching retransmission entries, leading to use-after-free on next PTO. An unprivileged attacker can trigger this by querying over DoQ, withholding ACKs, sending RESET_STREAM, and waiting for PTO, causing abnormal server exit.
- CVE-2026-77955Medium
In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, in zones with ZONEMD enabled (zonemd-check: yes) located below a trust anchor, there is an attack window where tampered zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution before the ZONEMD check completes. If a zonefile is written to disk while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again.
- CVE-2026-77860Low
In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.
Original NVD description (English source)
In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a 'response-ip'/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator's configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator's configured target.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS