CVE-2026-55717

A flaw in Unbound allows a remote attacker controlling a delegated domain to trigger a NULL pointer dereference and crash the daemon. Exploitation occurs when serve-expired: yes and specific response-ip or RPZ rules are configured, resulting in a denial of service.

This Moderate severity denial of service flaw in Unbound requires specific configurations, including serve-expired: yes and either response-ip or RPZ CNAME override rules. Exploitation depends on a remote attacker controlling a delegated domain and delaying DNS responses, which limits the immediate impact on typical Red Hat Unbound deployments not utilizing these advanced features.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure serve-expired remains disabled (default), or set serve-expired-client-timeout: 0 to bypass the vulnerable callback path. If serving expired answers is necessary, remove any response-ip CNAME redirect rules and RPZ rpz-cname-override entries. Additionally, use access-control to restrict query access, preventing untrusted clients from triggering the flaw via attacker-controlled names.