CVE-2026-55717

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.10.0 through 1.25.1

Description A remote client controlling a delegated domain can cause the daemon to crash, leading to a denial of service. This occurs when the serve-expired: yes setting is enabled alongside a response-ip: <net> redirect or response-ip-data: <net> CNAME <target> rule, or the equivalent rpz-cname-override. The issue stems from the serve-expired-client-timeout() function, which executes a two-pass loop to follow a CNAME alias generated by response-ip. During the second pass, the function resets the alias rrset variable but fails to reset partial rep, resulting in a NULL pointer dereference. An attacker can trigger this by controlling a zone that returns an A/AAAA record within the configured response-ip/rpz subnet and delaying the response after the previous record has expired.

Recommendations Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, disable the serve-expired: yes setting or restrict the use of response-ip and rpz-cname-override rules.