CVE-2026-55717 in Unbound
Summary
by MITRE • 07/22/2026
In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of 'serve-expired-client-timeout' is taken leading to denial of service via the server crash.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists in NLnet Labs Unbound DNS resolver versions 1.10.0 through 1.25.1 and represents a critical denial of service flaw that can be exploited remotely by attackers controlling delegated domains. The issue manifests when the configuration combines 'serve-expired: yes' with response-ip redirect rules or RPZ cname override mechanisms, creating a dangerous interaction between expired record handling and alias resolution processes. The vulnerability stems from an inconsistent state management within the serve-expired-client-timeout callback function that executes during expired record processing.
The technical flaw occurs in the two-pass loop implementation designed to chase respip-generated CNAME aliases. During this process, the system properly resets the 'alias_rrset' variable on the second pass but fails to reset the 'partial_rep' variable accordingly. This inconsistency creates a dangerous state where memory references become invalid, leading to a NULL pointer dereference when the daemon attempts to access improperly managed data structures. The vulnerability is classified under CWE-476 as a NULL pointer dereference, representing a fundamental memory management error that can be exploited for remote code execution or system instability.
The operational impact of this vulnerability extends beyond simple service disruption, as it enables malicious actors to perform targeted denial of service attacks against Unbound resolver instances. Attackers need only control any zone that responds with A/AAAA records within the configured response-ip or RPZ subnet range to trigger the vulnerable code path. When an expired record is encountered and the server delays its response, the specific timeout callback function executes the flawed two-pass loop, causing the daemon to crash and restart. This creates a persistent availability threat that can be amplified through coordinated attacks against multiple resolver instances.
Mitigation strategies should focus on immediate configuration changes to avoid the problematic combination of serve-expired with response-ip redirect rules, particularly in production environments where external domain control is possible. Administrators should consider implementing stricter access controls for delegated domains and monitoring for suspicious DNS query patterns that might indicate exploitation attempts. The vulnerability aligns with ATT&CK technique T1499.004 for network denial of service and represents a critical security gap that requires immediate patching or configuration remediation. Organizations should also implement proper input validation and memory management checks to prevent similar issues in other DNS resolver implementations.