Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-50248

BOGUS configured primary hostname accepted for XFR in auth/rpz zones

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
NLnet Labs

Description

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary and can replaces the entire zone/the resolver's entire response policy.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

NLnet Labs Unbound

Default version status: unaffected

  • 1.7.0 to < 1.25.2affected

References