The CVE number for this vulnerability is CVE-2026-50243.


== Summary
When Unbound is configured with the 'respip' module in front of the validator
together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP
trigger, the rewriting handler does not check the security status of the
upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an
operator's configured IP.

Unbound 1.25.2 includes a fix to ensure that 'response-ip'/RPZ-IP rewrite logic
does not process BOGUS answers.


== Affected products
Unbound 1.6.2 up to and including version 1.25.1.


== Description
If the validator finds an expired or otherwise invalid RRSIG on an answer whose
A record falls within a 'response-ip'/RPZ configuration, the answer is still
rewritten and given a hard coded security level of INSECURE.
This results in the client receiving an INSECURE NOERROR reply rewritten by
the operator's configured IP.

A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS
A/AAAA answer that falls inside the operator's configured subnet rewrites.
Such DNSSEC protected answers are then insecurely redirected to the operator's
configured target.

Unbound 1.25.2 includes a fix to ensure that 'response-ip'/RPZ-IP rewrite logic
does not process BOGUS answers.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-50243.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-50243.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.