NLnet Labs Unbound EUVD-2026-47673

Exploitation requires three concurrent conditions: (1) Unbound must have the respip module loaded and positioned before the validator in the module-config directive in unbound.conf; (2) at least one response-ip redirect rule or an RPZ file with an RPZ-IP trigger must be active - response-ip NXDOMAIN or NODATA policy actions without redirect rules are not sufficient; (3) the attacker must be capable of injecting a forged DNS A/AAAA response where the spoofed IP address falls within the operator's configured redirect subnet, requiring on-path network positioning or control of an upstream resolver. Passive observers and fully off-path attackers cannot trigger the flaw. Deployments using Unbound without the respip module are not affected. DNSSEC-validating stub resolvers that independently verify signatures downstream of Unbound are not impacted by Unbound suppressing BOGUS status to INSECURE.

The CVSS 4.0 score of 6.3 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N) accurately reflects a medium-severity issue with meaningful real-world constraints. AC:H is justified by the dual requirement: the Unbound deployment must have respip configured ahead of the validator with active redirect rules, AND the attacker must be positioned to inject a forged DNS response whose A record lands within a configured redirect subnet - a non-trivial network positioning requirement. The integrity impact is bounded (VI:L/SI:L) because the attack redirects DNS responses rather than achieving full resolution compromise, and DNSSEC-validating stub resolvers that independently verify signatures are not impacted by Unbound returning INSECURE rather than SERVFAIL. No CISA KEV listing and no public exploit code are identified, reducing urgency compared to actively exploited issues of similar score. Risk is highest for ISP resolvers, enterprise DNS policy enforcement platforms, and RPZ-based sinkhole deployments where the respip-before-validator configuration pattern is operationally common. The attack is most plausible where an adversary can perform on-path DNS response injection via compromised upstream resolvers or BGP route hijacking.

An attacker with on-path positioning - such as a compromised upstream resolver or BGP route hijack enabling DNS response injection - crafts a forged A/AAAA answer for a DNSSEC-protected domain whose spoofed IP falls within a subnet covered by the target Unbound server's response-ip or RPZ-IP redirect configuration. Unbound's respip module rewrites the response to the operator's configured redirect target before the validator can reject the BOGUS RRSIG, returning the response to clients with a hardcoded INSECURE status instead of SERVFAIL. No public proof-of-concept exploit has been identified at time of analysis.