The CVE number for this vulnerability is CVE-2026-55717.


== Summary
When 'serve-expired: yes' is set together with a 'response-ip: <net> redirect'
/'response-ip-data: <net> CNAME <target>' rule (or the RPZ
'rpz-cname-override' equivalent), a remote client who controls any delegated
domain can crash the daemon.
The serve-expired-client-timeout callback runs a two-pass loop to chase the
respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but
not 'partial_rep'.
Later, this inconsistency leads to a NULL pointer dereference and an eventual
crash.

Unbound 1.25.2 includes a fix to correctly set the partial reply to NULL as
well after the merge on the second loop iteration.


== Affected products
Unbound 1.10.0 up to and including version 1.25.1.


== Description
A malicious actor can exploit the vulnerability by controlling any zone that
replies with an A/AAAA record that falls inside the configured response-ip/rpz
subnet.
By delaying the answer when the previous record has expired, the vulnerable
path of 'serve-expired-client-timeout' is taken leading to denial of service
via the server crash.

Unbound 1.25.2 includes a fix to correctly set the partial reply to NULL as
well after the merge on the second loop iteration.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-55717.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-55717.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks, also Xin Wang,
Jiapeng Li, and Jiajia Liu, Northwestern Polytechnical University, for
discovering and responsibly disclosing the vulnerability.