CVE-2026-50243

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.6.2 through 1.25.1

Description When configured with the respip module before the validator, along with a response-ip redirect rule or an RPZ file using an RPZ-IP trigger, the rewriting handler fails to verify the security status of the upstream answer. This allows the system to rewrite a BOGUS A/AAAA answer to an operator-configured IP. If the validator detects an expired or invalid RRSIG (Resource Record Signature) on an answer within a response-ip or RPZ configuration, the answer is rewritten and assigned a hard-coded security level of INSECURE. Consequently, clients receive an INSECURE NOERROR reply. An attacker can exploit this by spoofing a BOGUS A/AAAA answer that falls within the configured subnet rewrites, causing DNSSEC protected answers to be insecurely redirected to the operator's target.

Recommendations Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, restrict the use of the respip module or avoid using response-ip redirect rules and RPZ-IP triggers until the software is updated.