CVE-2026-55717
Received Received - Intake

Denial of Service in Unbound DNS Server

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of 'serve-expired-client-timeout' is taken leading to denial of service via the server crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-55717
EUVD
EUVD-2026-47680

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound to 1.25.1 (inc)
nlnet_labs unbound From 1.10.0 (inc) to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects NLnet Labs Unbound DNS software versions 1.10.0 through 1.25.1. When configured with 'serve-expired: yes' and response-ip redirect or CNAME rules, a remote attacker controlling a delegated domain can crash the Unbound daemon. The issue stems from a NULL pointer dereference in the 'serve-expired-client-timeout' callback during CNAME chasing, causing a denial of service.

Detection Guidance

Check if your Unbound version is between 1.10.0 and 1.25.1 by running 'unbound -v'. If affected, verify if 'serve-expired: yes' is set in the configuration and if 'response-ip' or 'response-ip-data' rules are present.

Impact Analysis

The vulnerability allows a remote attacker to crash the Unbound DNS server, disrupting DNS resolution services. This results in a denial of service, preventing users from accessing websites or other network resources until the server is restarted or patched.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the Unbound DNS server, which could disrupt DNS resolution services. For compliance with standards like GDPR or HIPAA, availability of critical systems is essential. A denial of service could impact data access or processing, potentially violating availability requirements under these regulations.

Mitigation Strategies

Upgrade Unbound to version 1.25.2 or later. If upgrading is not possible, manually apply the patch provided by NLnet Labs or disable the 'serve-expired' feature and remove 'response-ip'/'response-ip-data' rules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55717. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart