CVE-2026-44608

A flaw was found in Unbound. When operating in a multi-threaded configuration with specific Response Policy Zones (RPZ) using 'rpz-nsip' or 'rpz-nsdname' triggers, a locking inconsistency during an RPZ zone transfer (XFR) reload can occur. This timing issue may allow an adversary to trigger a heap use-after-free vulnerability, leading to a system crash and a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid using rpz-nsip or rpz-nsdname triggers within Response Policy Zones (RPZ) that are configured for zone transfer (XFR) reloads. Alternatively, configure Unbound to use local RPZ files instead of XFR for these zones, as local RPZ files do not trigger the vulnerability. A restart of the Unbound service may be required for configuration changes to take effect, which could temporarily interrupt DNS resolution.