CVE-2026-50248

Published: Lug 22, 2026 Last Modified: Lug 24, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: low

Description

AI Translation Available

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary and can replaces the entire zone/the resolver's entire response policy.

345

Insufficient Verification of Data Authenticity

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Other
Potential Impacts:
Varies By Context Unexpected State
Applicable Platforms
Technologies: ICS/OT
View CWE Details
Application

Unbound by Nlnetlabs

Product Information
Vendor Nlnetlabs
Product Unbound
Version Range Affected
From 1.7.0 (inclusive)
To 1.25.2 (exclusive)
cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50248.t…
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50248.txt