Quick answers
- Is CVE-2026-52863 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-52863 being exploited in the wild.
- How severe is CVE-2026-52863?
- Medium severity, with a CVSS score of 5.9, published 22 July 2026.
- Which products and versions are affected?
- NLnet Labs Unbound 1.25.0 to 1.25.1.
- Is there a fix for CVE-2026-52863?
- A patch was published on 2026-07-22: Fixed in version 1.25.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-52863 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-52863?
- Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free vulnerability (CWE-416) exists in Unbound versions 1.25.0 through 1.25.1 due to the creation of a shallow copy of a 'view name' when the 'respip' and 'dns64' modules interact. The vulnerability is triggered when Unbound is configured with 'respip' or 'rpz' modules alongside subquery-attaching modules (like dns64 or subnetcache) and 'access-control-view'. Under high load, Unbound's 'jostle' logic may drop a super query that owns the original view name, leaving the subquery with a dangling pointer. This leads to memory corruption or a server crash, particularly in builds with memory protections like ASAN. The issue is resolved in version 1.25.2.
Affected products
- NLnet Labs Unbound 1.25.0 to 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in version 1.25.2