CVE-2026-50248

NameCVE-2026-50248
DescriptionIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary and can replaces the entire zone/the resolver's entire response policy.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
unbound (PTS)bullseye1.13.1-1+deb11u2vulnerable
bullseye (security)1.13.1-1+deb11u7vulnerable
bookworm1.17.1-2+deb12u4vulnerable
bookworm (security)1.17.1-2+deb12u3vulnerable
trixie (security), trixie1.22.0-2+deb13u3vulnerable
forky, sid1.26.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
unboundsource(unstable)1.25.2-1

Notes

https://community.nlnetlabs.nl/t/unbound-1-25-2-released/3430

Search for package or bug name: Reporting problems