CVE-2026-55717: CWE-476: NULL Pointer Dereference in NLnet Labs Unbound
In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of 'serve-expired-client-timeout' is taken leading to denial of service via the server crash.
AI Analysis
Technical Summary
CVE-2026-55717 is a NULL pointer dereference vulnerability in NLnet Labs Unbound DNS server versions 1.10.0 up to and including 1.25.1. When the 'serve-expired: yes' option is enabled along with a 'response-ip: <net> redirect' or 'response-ip-data: <net> CNAME <target>' rule (or the equivalent RPZ 'rpz-cname-override'), the serve-expired-client-timeout callback performs a two-pass loop chasing the respip-generated CNAME alias. On the second pass, it resets 'alias_rrset' but not 'partial_rep', causing an inconsistent state that leads to a NULL pointer dereference and daemon crash. An attacker controlling any delegated domain that replies with an A/AAAA record within the configured response-ip or RPZ subnet can exploit this by delaying responses for expired records, triggering a denial of service via server crash.
Potential Impact
The vulnerability allows a remote unauthenticated attacker to cause a denial of service by crashing the Unbound DNS daemon. This results in service disruption but does not impact confidentiality or integrity. The CVSS v3.1 base score is 5.9 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling 'serve-expired: yes' or avoid using the specific 'response-ip' or RPZ CNAME override rules that trigger this issue to mitigate risk. Monitor NLnet Labs advisories for updates and apply official patches once released.
CVE-2026-55717: CWE-476: NULL Pointer Dereference in NLnet Labs Unbound
Description
In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of 'serve-expired-client-timeout' is taken leading to denial of service via the server crash.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-55717 is a NULL pointer dereference vulnerability in NLnet Labs Unbound DNS server versions 1.10.0 up to and including 1.25.1. When the 'serve-expired: yes' option is enabled along with a 'response-ip: <net> redirect' or 'response-ip-data: <net> CNAME <target>' rule (or the equivalent RPZ 'rpz-cname-override'), the serve-expired-client-timeout callback performs a two-pass loop chasing the respip-generated CNAME alias. On the second pass, it resets 'alias_rrset' but not 'partial_rep', causing an inconsistent state that leads to a NULL pointer dereference and daemon crash. An attacker controlling any delegated domain that replies with an A/AAAA record within the configured response-ip or RPZ subnet can exploit this by delaying responses for expired records, triggering a denial of service via server crash.
Potential Impact
The vulnerability allows a remote unauthenticated attacker to cause a denial of service by crashing the Unbound DNS daemon. This results in service disruption but does not impact confidentiality or integrity. The CVSS v3.1 base score is 5.9 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling 'serve-expired: yes' or avoid using the specific 'response-ip' or RPZ CNAME override rules that trigger this issue to mitigate risk. Monitor NLnet Labs advisories for updates and apply official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- NLnet Labs
- Date Reserved
- 2026-06-22T12:27:22.813Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a60c4229c2644c7f80e9253
Added to database: 07/22/2026, 13:22:42 UTC
Last enriched: 07/22/2026, 13:38:38 UTC
Last updated: 07/23/2026, 01:08:17 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.