PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55717 NLnet Labs CVE debrief

A denial of service vulnerability exists in Unbound versions 1.10.0 through 1.25.1. When 'serve-expired: yes' is set along with a 'response-ip: <net> redirect' or 'response-ip-data: <net> CNAME <target>' rule, a remote client can crash the daemon. This is achieved by controlling any delegated domain and exploiting the 'serve-expired-client-timeout' callback, leading to a NULL pointer dereference and server crash. The vulnerability arises from the 'serve-expired-client-timeout' callback, which performs a two-pass loop to chase the respip-generated CNAME alias. On the second pass, it resets 'alias_rrset' but not 'partial_rep', leading to an inconsistency that causes a NULL pointer dereference and eventual crash.

Vendor
NLnet Labs
Product
Unbound
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-22
Original CVE updated
2026-07-22
Advisory published
2026-07-22
Advisory updated
2026-07-22

Who should care

Administrators and users of Unbound versions 1.10.0 through 1.25.1 should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing and adjusting Unbound configurations to prevent exploitation, monitoring Unbound services for unusual activity, and updating Unbound to a version that fixes this vulnerability.

Technical summary

The vulnerability arises from the 'serve-expired-client-timeout' callback, which performs a two-pass loop to chase the respip-generated CNAME alias. On the second pass, it resets 'alias_rrset' but not 'partial_rep', leading to an inconsistency that causes a NULL pointer dereference and eventual crash. An attacker can exploit this by controlling any zone that replies with an A/AAAA record within the configured response-ip/rpz subnet and delaying the answer when the previous record has expired. This leads to denial of service via the server crash.

Defensive priority

Medium

Recommended defensive actions

  • Update Unbound to a version that fixes this vulnerability
  • Review and adjust Unbound configuration to prevent exploitation
  • Monitor Unbound services for unusual activity
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-22T14:17:21.537Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. This information is based on the supplied source corpus and may not reflect the current status of the vulnerability. Defenders should verify the current status and affected scope with the vendor or other reliable sources.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-22T14:17:21.537Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.