CVE-2026-50243

A flaw in Unbound's respip module fails to verify the security status of incoming DNS answers when using response-ip rules or RPZ files. A remote attacker can exploit this by spoofing DNS answers to bypass DNSSEC protections and trigger unauthorized rewrites, redirecting clients to unintended locations.

This vulnerability has a Low impact because it requires Unbound to be specifically configured with the 'respip' module and either a 'response-ip' redirect rule or an RPZ file. This non-default setup allows a remote attacker to spoof DNS answers, resulting in the insecure redirection of DNSSEC protected responses.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If IP-based rewriting is unused, leave module-config configured as "validator iterator" and do not configure response-ip redirects or RPZ-IP triggers. If these features are required, ensure validator is placed before respip in module-config and restrict upstream peer access to reduce exposure to spoofed DNS answers.