Log in Start free

Vulnerability · Published Jul 22, 2026 · Assigned by NLnet Labs

CVE-2026-55717'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

Medium 5.9

In plain English

A medium-severity null pointer dereference in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.2%top 85.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of 'serve-expired-client-timeout' is taken leading to denial of service via the server crash.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.22unbound1.25.2-r0ALPINE-CVE-2026-55717
Alpine:v3.23unbound1.25.2-r0ALPINE-CVE-2026-55717
Alpine:v3.24unbound1.25.2-r0ALPINE-CVE-2026-55717
Debian:12unboundno fix listedDEBIAN-CVE-2026-55717
Debian:13unbound1.26.1-0+deb13u1DEBIAN-CVE-2026-55717
Debian:14unbound1.25.2-1DEBIAN-CVE-2026-55717
Ubuntu:22.04:LTSunboundno fix listedUBUNTU-CVE-2026-55717
Ubuntu:24.04:LTSunboundno fix listedUBUNTU-CVE-2026-55717
Ubuntu:26.04:LTSunboundno fix listedUBUNTU-CVE-2026-55717
Ubuntu:26.10unboundno fix listedUBUNTU-CVE-2026-55717

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound 1.10.0 – before 1.25.2

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References