CVE-2026-50248

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.7.0 through 1.25.1

Description An issue exists where an auth/rpz zone with a configured primary hostname that resolves to BOGUS A/AAAA records is still treated as a potential XFR endpoint. XFR (Zone Transfer) is a mechanism used to replicate DNS zone data from a primary server to a secondary server. A malicious actor capable of spoofing the hostname's A/AAAA record, without needing a valid RRSIG, can assume the role of the zone's XFR primary and replace the entire zone or the resolver's complete response policy.

Recommendations Update NLnet Labs Unbound to a version later than 1.25.1.