In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect'… (CVE-2026-55717)

In NLnet Labs Unbound versions 1.10.0 up to and including 1.25.1, when the 'serve-expired: yes' option is enabled together with a 'response-ip: <net> redirect' or 'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client controlling any delegated domain can crash the Unbound daemon. The vulnerability arises because the serve-expired-client-timeout callback performs a two-pass loop chasing the respip-generated CNAME alias; on the second pass, it resets 'alias_rrset' but not 'partial_rep', leading to an inconsistency that causes a NULL pointer dereference and daemon crash. Exploitation requires the attacker to control a zone that replies with an A/AAAA record within the configured response-ip or RPZ subnet and to delay the answer when the previous record has expired, triggering the vulnerable code path and causing denial of service.

Successful exploitation results in a denial of service condition by crashing the Unbound DNS resolver daemon. There is no impact on confidentiality or integrity, but availability is affected due to the server crash. The CVSS v3.1 score is 5.9 (medium severity) reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should consider disabling 'serve-expired: yes' or avoid using 'response-ip' redirect or RPZ CNAME override rules in combination. Monitoring for unusual crashes and applying any vendor-provided updates promptly is recommended once available.