NLnet Labs Unbound EUVD-2026-47677

Exploitation requires ALL four of the following non-default conditions to be simultaneously true: (1) Unbound is configured with the 'respip' or 'rpz' module; (2) a module capable of attaching subqueries is also active - specifically dns64, subnetcache, or respip CNAME redirection; (3) at least one 'access-control-view' directive is configured, which causes view name assignment to queries; and (4) the server is under sufficient query pressure that the jostle eviction mechanism activates and begins dropping slow queries. None of these conditions are present in a default Unbound installation. Exploitation is further limited by memory allocator behavior and heap layout at time of the free - the vendor explicitly states crash likelihood is low. No authentication is required from the attacker's perspective (DNS queries are unauthenticated), but the server-side configuration gates are the primary limiting factor for real-world exposure.

Real-world risk is meaningfully lower than the CVSS 5.9 score might imply in isolation. The AC:H vector metric correctly reflects that exploitation requires a highly specific and rare configuration intersection: respip/rpz modules active, a subquery-attaching module (dns64, subnetcache, or respip CNAME redirection) enabled, an access-control-view configured, and the server operating under sufficient query pressure to trigger jostle eviction. All four conditions must coincide. The vendor itself characterizes crash likelihood as low, contingent on memory allocator behavior and layout - introducing additional uncertainty that CVSS does not capture. No EPSS data was provided, and with no POC and no KEV listing, the exploitation probability signal is effectively neutral. SSVC assessment: exploitation status is 'none'; technical impact is partial (DoS only, no C/I impact); not trivially automatable due to load dependency. This is a real but operationally low-urgency issue for most deployments - highest priority for organizations running dns64 or RPZ with access-control-views on high-traffic resolvers.

An attacker sends a sustained flood of DNS queries to a targeted Unbound resolver configured with RPZ/respip, dns64, and access-control-view, driving it into jostle-eviction mode under load. A subquery in flight holds a shallow pointer to a view name string whose parent query is simultaneously evicted and freed; the subquery's subsequent access to that freed memory region causes heap corruption. Depending on memory layout and allocator behavior, the resolver may crash (DoS) or silently continue with corrupted state - the vendor indicates a crash is the more likely of these outcomes.