CVE-2026-50243
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Unbound from 1.6.2 up to 1.25.1, when configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. An attacker can exploit this by spoofing BOGUS A/AAAA answers.
Risk Assessment
The vulnerability allows an attacker to bypass DNSSEC validation and redirect clients to malicious IP addresses, potentially leading to traffic interception or man-in-the-middle attacks.
Recommendation
Update Unbound to a version above 1.25.1 that includes the fix. As a temporary measure, consider disabling the 'respip' module or 'response-ip' rules.
Original NVD description (English source)
In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a 'response-ip'/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator's configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator's configured target.