Xin Wang

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.10.0 through 1.25.1 **Description** A remote client controlling a delegated domain can cause the daemon to crash, leading to a denial of service. This occurs when the `serve-expired: yes` setting is enabled alongside a `response-ip: <net> redirect` or `response-ip-data: <net> CNAME <target>` rule, or the equivalent `rpz-cname-override`. The issue stems from the `serve-expired-client-timeout()` function, which executes a two-pass loop to follow a CNAME alias generated by response-ip. During the second pass, the function resets the `alias rrset` variable but fails to reset `partial rep`, resulting in a NULL pointer dereference. An attacker can trigger this by controlling a zone that returns an A/AAAA record within the configured response-ip/rpz subnet and delaying the response after the previous record has expired. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, disable the `serve-expired: yes` setting or restrict the use of `response-ip` and `rpz-cname-override` rules.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.20.0 through 1.25.1 **Description** An issue exists when the software is configured with `serve-expired: yes` and `serve-expired-client-timeout` is greater than `discard-timeout` (where `discard-timeout` is greater than 0). In this specific configuration, the `discard-timeout` branch within the serve expired logic drops an aged client reply without correctly decrementing the counter for the number of reply addresses for the query. Because the counter is not decremented, it can reach its maximum limit, causing new clients for duplicate in-flight queries to be silently dropped, which leads to a degradation of the resolution service. A malicious actor can trigger this by querying the resolver for a client-controlled slow-on-demand authoritative zone to push the counter past the threshold. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. Ensure that `serve-expired-client-timeout` is not configured to be greater than `discard-timeout` when `serve-expired` is enabled.