In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of… (CVE-2026-52863)

In NLnet Labs Unbound versions 1.25.0 up to and including 1.25.1, a fix designed to allow the 'respip' and 'dns64' modules to work together creates a shallow copy of the view name in effect. If Unbound is configured with 'respip' or 'rpz' modules alongside modules that attach subqueries (such as respip CNAME redirection, dns64, subnetcache) and an 'access-control-view', and the server is under memory pressure causing slow queries to be dropped, the shallow copy of the view name may become invalid if the original owner is removed. This can lead to memory corruption. The probability of a crash is low and depends on the underlying memory allocator and layout. Debug memory builds like ASAN can detect the issue and terminate the server.

The vulnerability can cause memory corruption leading to potential server crashes (denial of service). There is no indication of confidentiality or integrity impact. The likelihood of exploitation is low due to dependency on specific memory conditions and configurations.

No official patch or fix status is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid configurations combining 'respip'/'rpz' modules with subquery-attaching modules and 'access-control-view' under high memory pressure, or monitor for updates from NLnet Labs regarding a fix.