The CVE number for this vulnerability is CVE-2026-52863.


== Summary
A fix in 1.25.0 that makes the 'respip' and 'dns64' work together, creates a
shallow copy of the view name in effect that could lead to memory corruption
if the owner of the original view name is jostled out when Unbound is under
pressure.

Unbound 1.25.2 includes a fix to properly copy the required view name.


== Affected products
Unbound 1.25.0 up to and including version 1.25.1.


== Description
Unbound needs to be configured with one of 'respip'/'rpz' modules, together
with a module that can attach subqueries (respip CNAME redirection, dns64,
subnetcache) and a configured 'access-control-view' while Unbound is under
pressure so that joslte logic kicks in and starts dropping slow queries.
The subquery is getting a shallow copy of the view name and if the super query
which owns the view name is jostled out, memory corruption can occur.
Likelihood of a crash is low, since it relies heavily on the underlying memory
allocator and the memory layout.
Debug memory builds (e.g., ASAN) that catch the free terminate the server.

Unbound 1.25.2 includes a fix to properly copy the required view name.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-52863_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-52863_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-52863.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.