Log in Start free

Vulnerability · Published Jul 22, 2026 · Assigned by NLnet Labs

CVE-2026-50248BOGUS configured primary hostname accepted for XFR in auth/rpz zones

Medium 6.5

In plain English

A medium-severity insufficient verification of data authenticity in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.1%top 97.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary and can replaces the entire zone/the resolver's entire response policy.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.22unbound1.25.2-r0ALPINE-CVE-2026-50248
Alpine:v3.23unbound1.25.2-r0ALPINE-CVE-2026-50248
Alpine:v3.24unbound1.25.2-r0ALPINE-CVE-2026-50248
Debian:12unboundno fix listedDEBIAN-CVE-2026-50248
Debian:13unbound1.26.1-0+deb13u1DEBIAN-CVE-2026-50248
Debian:14unbound1.25.2-1DEBIAN-CVE-2026-50248
Ubuntu:22.04:LTSunboundno fix listedUBUNTU-CVE-2026-50248
Ubuntu:24.04:LTSunboundno fix listedUBUNTU-CVE-2026-50248
Ubuntu:26.04:LTSunboundno fix listedUBUNTU-CVE-2026-50248
Ubuntu:26.10unboundno fix listedUBUNTU-CVE-2026-50248

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound 1.7.0 – before 1.25.2

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

References