In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary and can replaces the entire zone/the resolver's entire response policy.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade unbound | Jul 29, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade unboundUpgrade unbound-utilsUpgrade unbound-libsUpgrade unbound-develUpgrade unbound-anchorUpgrade python3-unboundUpgrade unbound-libs-debuginfoUpgrade unbound-anchor-debuginfoUpgrade unbound-debuginfoUpgrade unbound-debugsourceUpgrade unbound-utils-debuginfoUpgrade python3-unbound-debuginfo | Aug 10, 2026 | Jul 22, 2026 |
| Debian | — | Upgrade unbound | Sep 21, 2026 | Jul 22, 2026 |
| Freebsd | — | Upgrade unbound | Jul 28, 2026 | Jul 25, 2026 |
| Redhat_linux | — | No solution exists | Aug 19, 2026 | Jul 22, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 10, 2026 | Jul 22, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub