In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is… (CVE-2026-50248)

In NLnet Labs Unbound versions 1.7.0 up to and including 1.25.1, when an authoritative or response policy zone (auth/rpz) has a configured primary hostname that resolves to BOGUS A/AAAA DNS records, the software incorrectly still considers this hostname as a possible zone transfer (XFR) endpoint. This flaw allows a malicious actor capable of spoofing the A/AAAA DNS records of the primary hostname—without requiring valid DNSSEC signatures (RRSIG)—to become the zone's XFR primary server. Consequently, the attacker can replace the entire zone data or the resolver's entire response policy, potentially altering DNS responses.

The vulnerability allows an unauthenticated attacker who can spoof DNS A/AAAA records of the primary hostname to hijack the zone transfer process. This can lead to complete replacement of the zone data or the resolver's response policy, impacting the integrity of DNS responses. There is no confidentiality or availability impact reported. The attack requires the ability to spoof DNS records but does not require valid DNSSEC signatures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid configuring auth/rpz zones with primary hostnames that resolve to BOGUS A/AAAA records or ensure that DNS spoofing is mitigated in their environment. Monitor vendor advisories for updates and apply official patches once released.