CVE-2026-50243 affects NLnet Labs Unbound DNS resolver versions 1.6.2 through 1.25.1 when configured with the 'respip' module preceding the validator and using 'response-ip' redirect rules or RPZ files with RPZ-IP triggers. The vulnerability arises because the rewriting handler fails to check the security status of upstream DNS answers before rewriting them. Specifically, if the validator detects an expired or invalid RRSIG on an answer whose A record matches a 'response-ip' or RPZ-IP configuration, the answer is still rewritten and assigned a hardcoded security level of INSECURE. This causes clients to receive INSECURE NOERROR replies redirected to operator-configured IP addresses. An attacker can exploit this by spoofing BOGUS A/AAAA DNS responses within the operator's configured subnet, causing DNSSEC-protected answers to be insecurely redirected, potentially enabling poisoning or redirection attacks.

The vulnerability allows an attacker to spoof BOGUS DNSSEC-protected A/AAAA records that fall within the operator's configured subnet rewrites, causing the Unbound resolver to rewrite these responses to operator-configured IP addresses with an INSECURE security status. This can lead to clients receiving incorrect DNS responses that redirect them to potentially malicious IPs, undermining DNSSEC protections and potentially enabling DNS poisoning or redirection attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should carefully review their use of the 'respip' module with 'response-ip' redirect rules or RPZ-IP triggers and consider disabling these features or applying configuration workarounds if possible to avoid exposure. Monitor NLnet Labs advisories for updates and patches addressing this issue.