NLnet Labs Unbound CVE-2026-55717

Two non-default configuration directives must be active simultaneously on the target Unbound instance: (1) serve-expired: yes in unbound.conf, which enables stale-cache serving via the serve-expired-client-timeout callback, and (2) at least one response-ip: <net> redirect or response-ip-data: <net> CNAME <target> rule, or an RPZ zone with an rpz-cname-override directive. The attacker must additionally hold DNS delegation authority over a zone whose A or AAAA responses resolve to an address within the subnet specified in those redirect rules. A timing condition also applies: a previously cached record for that name must have expired so that the serve-expired path is taken rather than a fresh resolution. Factors limiting exploitation: both features must be explicitly co-configured by the operator (neither is enabled by default); the attacker requires actual DNS delegation authority over a relevant zone, not merely the ability to send crafted packets; and exploitation depends on cache expiration timing, introducing uncertainty in attack execution.

The NVD CVSS 3.1 score of 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H appropriately characterizes the realistic exploitation difficulty. AC:H is well-justified: the attacker must simultaneously satisfy three conditions - the target Unbound instance must have serve-expired enabled, it must have response-ip or RPZ CNAME redirect rules configured, and the attacker must control a delegated DNS zone whose A/AAAA records resolve to an address within the configured subnet. A fourth timing condition applies: the previously cached record must have expired so that the serve-expired-client-timeout callback is invoked. Both serve-expired and response-ip are non-default operator configurations, significantly narrowing the exposed population. Impact is restricted to high availability loss (daemon crash, A:H) with no confidentiality or integrity exposure. No EPSS score was provided in the input data, no CISA KEV listing exists, and no public exploit code has been identified - all three absence signals are consistent with a vulnerability that requires specific deployment conditions. For resolvers that do not co-configure these two features, risk is effectively zero; for those that do, the availability impact of a crashable public-facing resolver is significant.

An attacker who operates or has compromised a delegated DNS zone whose A or AAAA records fall within the resolver's configured response-ip or RPZ subnet waits until those records expire from Unbound's cache, then sends a DNS query to the resolver. The resolver invokes the serve-expired-client-timeout callback, which attempts a two-pass CNAME alias chase for the response-ip redirect; on the second pass the inconsistent state of alias_rrset and partial_rep triggers a null pointer dereference, crashing the Unbound daemon and denying DNS resolution to all clients dependent on that resolver. No public POC exists at time of analysis.