Skip to main content

NLnet Labs Unbound CVE-2026-50243

| EUVDEUVD-2026-47673 MEDIUM
Use of Less Trusted Source (CWE-348)
2026-07-22 NLnet Labs GHSA-vqq3-g95x-fpmr
Information Disclosure Red Hat Suse Unbound Nlnet Labs
6.3
CVSS 4.0 · Vendor: NLnet Labs
Share

Severity by source

Vendor (NLnet Labs) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.0 MEDIUM

Network vector for DNS response injection; AC:H for required respip module ordering and on-path position; scope changed as clients beyond the resolver receive misdirected responses.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat
3.7 LOW
qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jul 22, 2026 - 16:18 EUVD
Analysis Generated
Jul 22, 2026 - 13:52 vuln.today

DescriptionCVE.org

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a 'response-ip'/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator's configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator's configured target.

AnalysisAI

DNS response policy rewriting in NLnet Labs Unbound 1.6.2 through 1.25.1 bypasses DNSSEC validation when the respip module is positioned ahead of the validator with response-ip or RPZ-IP redirect rules active. The rewriting handler fails to check upstream DNSSEC security status, allowing a spoofed BOGUS A/AAAA answer whose address falls within an operator-configured redirect subnet to be rewritten and returned to clients with a hardcoded INSECURE security level rather than being rejected as BOGUS. No public exploit code has been identified at time of analysis, but the integrity impact is concrete: clients receive silently misdirected responses that appear to pass through legitimate operator-controlled policy, undermining the core DNSSEC trust guarantee for affected deployments.

Technical ContextAI

Unbound (CPE: cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:*) is a validating, recursive DNS resolver that supports response policy via two mechanisms: operator-defined response-ip redirect rules and RPZ (Response Policy Zones) with RPZ-IP triggers. The respip module intercepts DNS answers and rewrites A/AAAA responses to operator-configured targets when the queried IP matches a configured redirect subnet. The vulnerability arises from processing order in the module stack: when respip is placed before the validator, it rewrites answers before DNSSEC validation can reject them. CWE-348 (Use of Less Trusted Source) captures the root cause precisely - the rewriting handler substitutes a less-trusted BOGUS answer (one carrying an expired or otherwise invalid RRSIG) into the response pipeline and hardcodes the resulting security level to INSECURE rather than propagating the upstream BOGUS status. The net effect is that DNSSEC-protected zones whose A records fall within configured redirect subnets can be silently hijacked at the rewriting layer, with the security state signal suppressed entirely.

RemediationAI

Upgrade to the patched Unbound release per the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50243.txt - the exact fixed version number is not independently confirmed from the data available at time of analysis and must be verified directly against that advisory. If immediate upgrade is not possible, the primary compensating control is to restructure the module-config directive in unbound.conf so the validator appears before respip in the module stack; this ensures BOGUS answers are rejected before the rewriting handler can process them, though it changes the behavior of RPZ-IP redirects on DNSSEC-failing domains and may affect intentional policy enforcement semantics. Alternatively, temporarily removing all response-ip redirect rules and RPZ-IP trigger entries from configuration eliminates the vulnerable code path entirely at the cost of disabling DNS policy enforcement. Operators relying on RPZ sinkholes for security filtering should treat the module-order reordering as a stopgap only and prioritize patching.

More in Unbound

View all
CVE-2019-18934 HIGH POC
7.3 Nov 19

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
CVE-2026-33278 CRITICAL
9.1 May 20

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
CVE-2026-42959 HIGH
8.7 May 20

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
CVE-2026-42944 HIGH
8.7 May 20

Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
CVE-2026-32665 HIGH
7.5 Jul 22

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
CVE-2026-55973 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone

CVE-2026-40691 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
CVE-2026-44690 HIGH
7.5 Jul 22

DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
CVE-2022-3204 HIGH
7.5 Sep 26

A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
CVE-2020-10772 HIGH
7.5 Nov 27

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020
CVE-2020-12663 HIGH
7.5 May 19

Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Rated high severity
CVE-2020-12662 HIGH
7.5 May 19

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. Rated high severity

Same weakness CWE-348 – Use of Less Trusted Source

View all
CVE-2022-31813 CRITICAL POC
9.8
CVE-2026-43634 HIGH POC
8.7
CVE-2025-55292 HIGH POC
8.2
CVE-2021-21374 HIGH POC
8.1
CVE-2022-2255 HIGH POC
7.5
CVE-2026-48772 CRITICAL
10.0
CVE-2021-21373 MEDIUM POC
5.9
CVE-2026-58122 CRITICAL
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

CVE-2026-50243 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy