CVE-2026-50243: Unbound DNS Information Disclosure Flaw

CVE-2026-50243 Overview

CVE-2026-50243 affects NLnet Labs Unbound, an open-source recursive DNS resolver. The vulnerability exists in versions 1.6.2 through 1.25.1 when Unbound runs the respip module in front of the validator alongside a response-ip redirect rule or an RPZ file with an RPZ-IP trigger. The rewriting handler does not verify the DNSSEC security status of the upstream answer before applying the operator's rewrite. As a result, BOGUS A/AAAA answers are rewritten to the operator's configured IP and delivered to clients with a hard-coded INSECURE security level. This weakens the DNSSEC guarantees the resolver is expected to enforce and maps to [CWE-348] Use of Less Trusted Source.

Critical Impact
A remote attacker can spoof BOGUS A/AAAA responses that fall within an operator's response-ip or RPZ-IP subnet. Unbound rewrites those forged answers to the operator's configured target and returns them as INSECURE NOERROR, bypassing DNSSEC validation.

Affected Products

NLnet Labs Unbound version 1.6.2
NLnet Labs Unbound versions between 1.6.2 and 1.25.1
NLnet Labs Unbound version 1.25.1

Discovery Timeline

2026-07-22 - CVE-2026-50243 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-50243

Vulnerability Analysis

Unbound supports operator-driven answer rewriting through the respip module. Operators use this to enforce response-ip policies or RPZ files containing RPZ-IP triggers that match specific IP addresses in A/AAAA responses. The rewrite is intended to redirect matched answers to an operator-controlled target.

The defect lies in the order and logic of processing. The respip module executes in front of the validator and applies the rewrite without checking whether the upstream answer passed DNSSEC validation. When the validator later marks the answer as BOGUS due to an expired or otherwise invalid RRSIG, the rewrite has already been applied and the resulting record is stamped with a hard-coded security level of INSECURE. The client then receives an INSECURE NOERROR reply pointing at the operator's configured IP.

Root Cause

The root cause is a trust boundary error. The rewriting handler treats an unvalidated upstream answer as authoritative enough to trigger a policy rewrite. Because the rewritten record is assigned INSECURE unconditionally, the downstream DNSSEC signal that would normally flag the answer as BOGUS is stripped. This aligns with [CWE-348], where data from a less-trusted source is used in place of a validated equivalent.

Attack Vector

An off-path or on-path attacker spoofs a BOGUS A or AAAA response whose record value falls inside a subnet covered by the operator's response-ip or RPZ-IP policy. Unbound accepts the forged answer, rewrites it to the operator's configured target, and returns INSECURE NOERROR to the client. DNSSEC-protected zones lose their integrity signal because the client never sees the BOGUS status. The attack requires no authentication and is delivered over the network, though exploitation depends on the specific rewrite configuration and successful spoofing of a matching response.

See the NLnet Labs advisory for CVE-2026-50243 for the vendor's technical description.

Detection Methods for CVE-2026-50243

Indicators of Compromise

DNS responses returned to clients with AD bit unset and security status INSECURE for names in zones known to be DNSSEC-signed.
Answers for DNSSEC-signed domains resolving to operator rewrite targets when the upstream answer would otherwise be BOGUS.
Unbound log entries showing respip rewrites applied to responses that the validator subsequently flags as BOGUS.

Detection Strategies

Audit Unbound configurations for concurrent use of the respip module, response-ip rules, or RPZ files with RPZ-IP triggers.
Compare Unbound resolver output against an independent validating resolver for DNSSEC-signed test domains to identify silent downgrades to INSECURE.
Enable Unbound query logging with val-log-level: 2 to record validation outcomes and correlate them with rewrite events.

Monitoring Recommendations

Ingest Unbound query and validation logs into a centralized analytics platform and alert on high volumes of INSECURE responses for zones that should be SECURE.
Monitor authoritative DNSSEC-signed zones for unexpected client resolution to internal rewrite targets.
Track version inventory of Unbound deployments and flag any instance running 1.6.2 through 1.25.1 with respip enabled.

How to Mitigate CVE-2026-50243

Immediate Actions Required

Identify all Unbound resolvers running versions 1.6.2 through 1.25.1 that load the respip module.
Upgrade affected resolvers to a fixed release published by NLnet Labs as soon as it is available in your distribution channel.
Review response-ip and RPZ-IP configurations to confirm which zones and subnets could be abused by spoofed BOGUS answers.

Patch Information

Refer to the NLnet Labs CVE-2026-50243 advisory for the fixed version and upgrade instructions. Apply vendor packages through your operating system's package manager once the patched release is published, and restart the unbound service to activate the fix.

Workarounds

Remove or disable the respip module until the resolver is patched if response-ip or RPZ-IP rewrites are not operationally required.
Replace RPZ-IP triggers with QNAME-based RPZ triggers where feasible, since the flaw is specific to IP-based rewrites over DNSSEC-signed responses.
Restrict recursive query access to trusted client networks using access-control to reduce the population of clients an attacker can target with spoofed responses.

bash

# Example: temporarily disable respip module in unbound.conf
# Before:
# module-config: "respip validator iterator"
# After:
module-config: "validator iterator"

# Restart the resolver to apply the change
sudo systemctl restart unbound

# Verify the loaded module chain
unbound-control status