CVE-2026-50248

A flaw in Unbound allows a remote attacker to replace an authenticated or Response Policy Zone (RPZ) by spoofing DNS records for configured primary hostnames. This enables the attacker to impersonate the primary server, leading to DNS cache poisoning or traffic redirection.

A Moderate impact flaw in Unbound allows a remote attacker to replace a resolver's Response Policy Zone (RPZ) by spoofing A/AAAA records for configured primary hostnames. If successful, an attacker can manipulate response policies, redirect traffic, or poison the DNS cache.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure Response Policy Zones (RPZ) and secondary zone primary endpoints using explicit IP addresses rather than hostnames to prevent A/AAAA spoofing or resolution flaws. Additionally, restrict network access for zone transfers to trusted sources and reload or restart the unbound service for configuration changes to take effect.