In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with… (CVE-2026-50243)

In NLnet Labs Unbound versions 1.6.2 up to and including 1.25.1, when configured with the 'respip' module preceding the validator and using 'response-ip' redirect rules or RPZ files with RPZ-IP triggers, the rewriting handler fails to check the security status of upstream DNS answers. Specifically, if the validator encounters an expired or invalid RRSIG on an answer whose A record matches a 'response-ip' or RPZ-IP configuration, the answer is rewritten and assigned a hardcoded INSECURE security level. This results in clients receiving INSECURE NOERROR replies that are rewritten to operator-configured IP addresses. A malicious actor can exploit this by spoofing BOGUS A/AAAA answers within the operator's configured subnet rewrites, causing DNSSEC-protected answers to be insecurely redirected.

Clients relying on Unbound with the affected configuration may receive DNS responses that are marked INSECURE and rewritten to operator-configured IP addresses despite the original DNSSEC validation failure. This undermines DNSSEC protections and could lead to redirection to unintended IPs, potentially facilitating malicious redirection or poisoning attacks. The CVSS score is 3.7 (medium severity), indicating limited impact with high attack complexity and no privileges required.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the 'respip' module or avoid using 'response-ip' redirect rules or RPZ-IP triggers in configurations where DNSSEC validation is critical.