CVE-2026-52863

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.25.0 through 1.25.1

Description A memory corruption issue exists when the software is under pressure and configured with an access-control-view and either the respip or rpz modules, alongside a module capable of attaching subqueries such as dns64, subnetcache, or respip CNAME redirection. The problem occurs because a shallow copy of the view name is created for the subquery; if the super query owning the original view name is jostled out (dropped to manage load), it can lead to memory corruption. The likelihood of a crash is low as it depends on the memory allocator and layout.

Recommendations Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, avoid configuring the respip or rpz modules in conjunction with dns64, subnetcache, or respip CNAME redirection when using access-control-view.