CVE-2026-50243

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer...

CVE-2026-50243 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer...

PT-2026-63388

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.10.0 through 1.25.1 Description A remote client controlling a delegated domain can cause the daemon to crash, leading to a denial of service. This occurs when the serve-expired: yes setting is enabled alongside a...