CVE-2026-55717

{
  "id": "CVE-2026-55717",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-22T14:17:21.537",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of 'serve-expired-client-timeout' is taken leading to denial of service via the server crash."
    },
    {
      "lang": "es",
      "value": "En NLnet Labs Unbound 1.10.0 hasta la versión 1.25.1 inclusive, cuando se configura ’serve-expired: yes’ junto con una regla ’response-ip: [net] redirect’ / ’response-ip-data: [net] CNAME [target]’ (o su equivalente RPZ ’rpz-cname-override’), un cliente remoto que controla cualquier dominio delegado puede provocar la caída del demonio. La función de callback serve-expired-client-timeout ejecuta un bucle de dos pasadas para seguir el alias CNAME generado por respip; en la segunda pasada, reinicia ’alias_rrset’ pero no ’partial_rep’. Posteriormente, esta inconsistencia conduce a una desreferencia de puntero NULL y a una caída eventual. Un actor malicioso puede explotar la vulnerabilidad controlando cualquier zona que responda con un registro A/AAAA que se encuentre dentro de la subred response-ip/rpz configurada. Al retrasar la respuesta cuando el registro anterior ha expirado, se toma la ruta vulnerable de ’serve-expired-client-timeout’, lo que lleva a una denegación de servicio a través de la caída del servidor."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NLnet Labs",
          "product": "Unbound",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.10.0",
              "lessThan": "1.25.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T14:07:12.831423Z",
          "id": "CVE-2026-55717",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.10.0",
              "versionEndExcluding": "1.25.2",
              "matchCriteriaId": "4B6C880D-74C8-4AA4-AA06-CF117E87BA82"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55717.txt",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}