CVE-2026-55717: NLnet Labs Unbound DoS Vulnerability

CVE-2026-55717 Overview

CVE-2026-55717 is a NULL pointer dereference vulnerability in NLnet Labs Unbound, a widely deployed validating, recursive, and caching DNS resolver. The flaw affects versions 1.10.0 through 1.25.1 when serve-expired: yes is enabled alongside a response-ip redirect rule or an RPZ rpz-cname-override rule. A remote attacker who controls any delegated domain can crash the Unbound daemon, producing a denial of service against the resolver. The issue is tracked under [CWE-476] and stems from inconsistent state cleanup during a two-pass CNAME chase in the serve-expired-client-timeout callback.

Critical Impact
Remote attackers controlling any delegated zone can crash Unbound resolvers, disrupting DNS resolution for all downstream clients.

Affected Products

NLnet Labs Unbound 1.10.0 through 1.25.1
Deployments configured with serve-expired: yes
Deployments using response-ip redirect or RPZ rpz-cname-override rules

Discovery Timeline

2026-07-22 - CVE CVE-2026-55717 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-55717

Vulnerability Analysis

The vulnerability lives in Unbound's serve-expired-client-timeout callback, which is invoked when a cached record has expired and Unbound is configured to serve stale data while a fresh answer is fetched. When a response-ip or rpz-cname-override rule rewrites the answer to a CNAME, the callback runs a two-pass loop to chase the alias generated by the response-ip subsystem.

On the second pass, the code resets alias_rrset but fails to reset the corresponding partial_rep structure. The two fields fall out of sync, and a later code path dereferences a pointer that is expected to be valid based on partial_rep, resulting in a NULL pointer dereference and process termination.

Root Cause

The root cause is incomplete state reset between iterations of the alias-chase loop. alias_rrset and partial_rep must be kept consistent, but only one of the two is cleared on the second pass. Subsequent code assumes the pair is coherent, and the mismatch produces the NULL dereference [CWE-476].

Attack Vector

An attacker needs authoritative control over any zone that returns an A or AAAA record falling inside the resolver's configured response-ip or RPZ subnet. By delaying the authoritative reply until after the previously cached record has expired, the attacker forces Unbound down the vulnerable serve-expired-client-timeout path. Once the alias chase runs its second pass, the daemon crashes. The attack requires no authentication and is triggered over the network, though it depends on specific server configuration and timing, which raises attack complexity.

No public exploit code is available. See the NLnet Labs advisory for CVE-2026-55717 for the vendor's technical description.

Detection Methods for CVE-2026-55717

Indicators of Compromise

Unexpected Unbound process crashes or restarts recorded by the service manager (systemd, supervisord, or equivalent).
Core dumps referencing the serve-expired-client-timeout callback or alias-chase code paths.
Repeated DNS resolution failures for clients following resolver crashes.

Detection Strategies

Monitor Unbound logs for abnormal termination, segmentation faults, and abrupt worker exits.
Correlate resolver crashes with queries targeting domains whose responses fall inside response-ip or RPZ subnets.
Track authoritative responses that arrive with unusual delay for zones covered by response-ip rules.

Monitoring Recommendations

Enable verbose Unbound logging (verbosity: 2 or higher) during triage to capture query and callback context.
Alert on repeated unbound process restarts within short time windows using host or SIEM telemetry.
Instrument DNS query latency and failure metrics to surface denial-of-service conditions quickly.

How to Mitigate CVE-2026-55717

Immediate Actions Required

Upgrade Unbound to a fixed release above 1.25.1 as published by NLnet Labs.
Inventory all Unbound instances and identify those running with serve-expired: yes combined with response-ip or RPZ CNAME overrides.
Restrict which upstream zones can be queried through the affected resolvers where operationally feasible.

Patch Information

NLnet Labs has published details and fixed versions in the official CVE-2026-55717 advisory. Apply the vendor-supplied update to remove the inconsistent reset of alias_rrset and partial_rep in the serve-expired-client-timeout callback.

Workarounds

Disable serve-expired by setting serve-expired: no until the patch is applied.
Remove response-ip redirect rules and rpz-cname-override entries that trigger the vulnerable code path.
Set serve-expired-client-timeout: 0 to disable the client-timeout callback that hosts the buggy alias chase.

bash

# Configuration example: disable the vulnerable code path in unbound.conf
server:
    serve-expired: no
    # or, if serve-expired must remain enabled, disable the client-timeout path:
    # serve-expired-client-timeout: 0

    # Remove or comment out response-ip redirects until patched:
    # response-ip: 192.0.2.0/24 redirect
    # response-ip-data: 192.0.2.0/24 "CNAME blocked.example."