PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50243 NLnet Labs CVE debrief

A vulnerability was found in NLnet Labs Unbound, a popular DNS resolver. The issue occurs when Unbound is configured with the 'respip' module and a 'response-ip' redirect rule or RPZ file with an RPZ-IP trigger. In such cases, the rewriting handler does not verify the security status of the upstream answer. Consequently, a BOGUS A/AAAA answer can be rewritten to point to an operator's configured IP, potentially leading to insecure DNS responses.

Vendor
NLnet Labs
Product
Unbound
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-22
Original CVE updated
2026-07-22
Advisory published
2026-07-22
Advisory updated
2026-07-22

Who should care

System administrators and security teams responsible for DNS infrastructure, particularly those using NLnet Labs Unbound, should be aware of this vulnerability. The MEDIUM severity rating suggests that while the vulnerability is not critical, it still poses a risk, especially if attackers can spoof BOGUS answers within the operator's configured subnet rewrites.

Technical summary

The vulnerability in NLnet Labs Unbound (CVE-2026-50243) arises from the 'respip' module's behavior when used with 'response-ip' redirect rules or RPZ files containing RPZ-IP triggers. When the validator encounters an expired or invalid RRSIG on an answer within a 'response-ip' or RPZ configuration, it rewrites the answer and assigns a hardcoded security level of INSECURE. This allows a malicious actor to potentially exploit the situation by spoofing a BOGUS A/AAAA answer that falls within the operator's configured subnet rewrites, leading to insecure redirection to the operator's target IP.

Defensive priority

Apply patches or updates provided by NLnet Labs for Unbound. Review and adjust Unbound configurations to ensure proper validation of upstream answers. Monitor DNS responses for anomalies.

Recommended defensive actions

  • Apply patches or updates provided by NLnet Labs for Unbound
  • Review and adjust Unbound configurations to ensure proper validation of upstream answers
  • Monitor DNS responses for anomalies
  • Verify the security status of upstream answers before rewriting
  • Consider implementing additional security measures such as DNSSEC validation

Evidence notes

The CVE record was published on 2026-07-22T14:17:20.240Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. Limited details are available from the CVE and NVD records.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-22T14:17:20.240Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.