Nixpkgs security tracker
6.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): High (H)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): Low (L)
Activity log
- Created suggestion
BOGUS configured primary hostname accepted for XFR in auth/rpz zones
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary and can replaces the entire zone/the resolver's entire response policy.
References
-
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50248.txt vendor-advisory
Affected products
- <1.25.2
Matching in nixpkgs
pkgs.unbound
Validating, recursive, and caching DNS resolver
pkgs.unbound-full
Validating, recursive, and caching DNS resolver
pkgs.unbound-with-systemd
Validating, recursive, and caching DNS resolver
pkgs.luaPackages.luaunbound
A binding to libunbound
pkgs.lua51Packages.luaunbound
A binding to libunbound
pkgs.lua52Packages.luaunbound
A binding to libunbound
pkgs.lua53Packages.luaunbound
A binding to libunbound
pkgs.lua54Packages.luaunbound
A binding to libunbound
pkgs.lua55Packages.luaunbound
A binding to libunbound
pkgs.luajitPackages.luaunbound
A binding to libunbound
pkgs.prometheus-unbound-exporter
Prometheus exporter for Unbound DNS resolver
pkgs.python313Packages.pyunbound
Python library for Unbound, the validating, recursive, and caching DNS resolver
pkgs.python314Packages.pyunbound
Python library for Unbound, the validating, recursive, and caching DNS resolver
pkgs.haskellPackages.unbound-generics
Support for programming with names and binders using GHC Generics
pkgs.haskellPackages.unbounded-delays
Unbounded thread delays and timeouts
pkgs.haskellPackages.unbound-kind-generics
Support for programming with names and binders using kind-generics
Package maintainers
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
-
@Scrumplex Sefa Eyeoglu <contact@scrumplex.net>