The CVE number for this vulnerability is CVE-2026-50248.


== Summary
When an auth/rpz zone has a configured primary hostname that resolves to BOGUS
A/AAAA, it is still considered as a possible XFR endpoint.

Unbound 1.25.2 includes a fix to disregard BOGUS configured primary hostnames
for XFR endpoints in auth/rpz zones.


== Affected products
Unbound 1.7.0 up to and including version 1.25.1.


== Description
A malicious actor that can spoof the hostname's A/AAAA record
(no valid RRSIG required) becomes the zone's XFR primary and can replaces the
entire zone/the resolver's entire response policy.

Unbound 1.25.2 includes a fix to disregard BOGUS configured primary hostnames
for XFR endpoints in auth/rpz zones.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-50248.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-50248.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.