PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50243 NLnet Labs CVE debrief

A vulnerability was found in NLnet Labs Unbound, a popular DNS resolver. The issue occurs when Unbound is configured with the 'respip' module and a 'response-ip' redirect rule or RPZ file with an RPZ-IP trigger. In such cases, the rewriting handler does not verify the security status of the upstream answer. Consequently, a BOGUS A/AAAA answer can be rewritten to point to an operator's configured IP, potentially leading to insecure DNS responses.

Vendor
NLnet Labs
Product
Unbound
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-22
Original CVE updated
2026-07-22
Advisory published
2026-07-22
Advisory updated
2026-07-22

Who should care

System administrators and security teams responsible for DNS infrastructure, particularly those using NLnet Labs Unbound, should be aware of this vulnerability. The MEDIUM severity rating suggests that while the vulnerability is not critical, it still poses a risk, especially if attackers can spoof BOGUS answers within the operator's configured subnet rewrites.

Technical summary

The vulnerability in NLnet Labs Unbound (CVE-2026-50243) arises from the 'respip' module's behavior when used with 'response-ip' redirect rules or RPZ files containing RPZ-IP triggers. When the validator encounters an expired or invalid RRSIG on an answer within a 'response-ip' or RPZ configuration, it rewrites the answer and assigns a hardcoded security level of INSECURE. This allows a malicious actor to potentially exploit the situation by spoofing a BOGUS A/AAAA answer that falls within the operator's configured subnet rewrites, leading to insecure redirection to the operator's target IP.

Defensive priority

Apply patches or updates provided by NLnet Labs for Unbound. Review and adjust Unbound configurations to ensure proper validation of upstream answers. Monitor DNS responses for anomalies.

Recommended defensive actions

  • Apply patches or updates provided by NLnet Labs for Unbound
  • Review and adjust Unbound configurations to ensure proper validation of upstream answers
  • Monitor DNS responses for anomalies
  • Verify the security status of upstream answers before rewriting
  • Consider implementing additional security measures such as DNSSEC validation

Evidence notes

The CVE record was published on 2026-07-22T14:17:20.240Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. Limited details are available from the CVE and NVD records.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50243 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50243

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50243 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50243

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.