The CVE number for this vulnerability is CVE-2026-55708.


== Description
The 'view_local_data' and 'view_local_datas' commands of 'unbound-control'
create a bare local zones tree for an already configured named view when the
view is configured with no local data to begin with.
However, the creation through the control interface omits adding the
default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion,
.localhost).
Once the local zone tree exists without the defaults, every query for a
default-protected name from a client mapped to that view escapes to the public
DNS via the iterator instead of being answered locally, bypassing local policy
expectations.

Unbound 1.25.2 includes a fix to make sure that the defaults are added when
creating view local zones via 'unbound-control'.


== Affected products
Unbound 1.6.0 up to and including version 1.25.1.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-55708.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-55708.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.