Executive brief
Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A vulnerability exists where a remote attacker can crash the DNS service by manipulating responses from a domain they control. This results in a denial-of-service, preventing users and systems from resolving domain names and potentially disrupting internet connectivity for the affected network.
Technical details
A NULL pointer dereference exists in the 'serve-expired-client-timeout' callback of NLnet Labs Unbound. When 'serve-expired' is enabled alongside 'response-ip' redirect or RPZ CNAME override rules, the callback's two-pass loop for chasing CNAME aliases fails to reset the 'partial_rep' pointer during the second pass, despite resetting 'alias_rrset'. An attacker controlling a delegated domain can trigger this inconsistency by returning an A/AAAA record within a configured response-ip subnet and delaying the response to force the 'serve-expired' code path. This leads to a daemon crash. The issue is fixed in Unbound version 1.25.2.
Affected products
- NLnet Labs Unbound 1.10.0 to 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in version 1.25.2