CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary and can replaces the entire zone/the resolver's entire response policy.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 3.2%

CVSS Severity

CVSS v3 Score 6.5

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50248.txt

Products affected by CVE-2026-50248

Nlnetlabs » Unbound » Version: 1.10.0

cpe:2.3:a:nlnetlabs:unbound:1.10.0
Nlnetlabs » Unbound » Version: 1.10.1

cpe:2.3:a:nlnetlabs:unbound:1.10.1
Nlnetlabs » Unbound » Version: 1.11.0

cpe:2.3:a:nlnetlabs:unbound:1.11.0
Nlnetlabs » Unbound » Version: 1.12.0

cpe:2.3:a:nlnetlabs:unbound:1.12.0
Nlnetlabs » Unbound » Version: 1.13.0

cpe:2.3:a:nlnetlabs:unbound:1.13.0
Nlnetlabs » Unbound » Version: 1.13.1

cpe:2.3:a:nlnetlabs:unbound:1.13.1
Nlnetlabs » Unbound » Version: 1.13.2

cpe:2.3:a:nlnetlabs:unbound:1.13.2
Nlnetlabs » Unbound » Version: 1.14.0

cpe:2.3:a:nlnetlabs:unbound:1.14.0
Nlnetlabs » Unbound » Version: 1.15.0

cpe:2.3:a:nlnetlabs:unbound:1.15.0
Nlnetlabs » Unbound » Version: 1.16.0

cpe:2.3:a:nlnetlabs:unbound:1.16.0
Nlnetlabs » Unbound » Version: 1.16.1

cpe:2.3:a:nlnetlabs:unbound:1.16.1
Nlnetlabs » Unbound » Version: 1.16.2

cpe:2.3:a:nlnetlabs:unbound:1.16.2
Nlnetlabs » Unbound » Version: 1.16.3

cpe:2.3:a:nlnetlabs:unbound:1.16.3
Nlnetlabs » Unbound » Version: 1.17.0

cpe:2.3:a:nlnetlabs:unbound:1.17.0
Nlnetlabs » Unbound » Version: 1.17.1

cpe:2.3:a:nlnetlabs:unbound:1.17.1
Nlnetlabs » Unbound » Version: 1.18.0

cpe:2.3:a:nlnetlabs:unbound:1.18.0
Nlnetlabs » Unbound » Version: 1.19.0

cpe:2.3:a:nlnetlabs:unbound:1.19.0
Nlnetlabs » Unbound » Version: 1.19.1

cpe:2.3:a:nlnetlabs:unbound:1.19.1
Nlnetlabs » Unbound » Version: 1.19.2

cpe:2.3:a:nlnetlabs:unbound:1.19.2
Nlnetlabs » Unbound » Version: 1.19.3

cpe:2.3:a:nlnetlabs:unbound:1.19.3
Nlnetlabs » Unbound » Version: 1.20.0

cpe:2.3:a:nlnetlabs:unbound:1.20.0
Nlnetlabs » Unbound » Version: 1.21.0

cpe:2.3:a:nlnetlabs:unbound:1.21.0
Nlnetlabs » Unbound » Version: 1.21.1

cpe:2.3:a:nlnetlabs:unbound:1.21.1
Nlnetlabs » Unbound » Version: 1.22.0

cpe:2.3:a:nlnetlabs:unbound:1.22.0
Nlnetlabs » Unbound » Version: 1.23.0

cpe:2.3:a:nlnetlabs:unbound:1.23.0
Nlnetlabs » Unbound » Version: 1.23.1

cpe:2.3:a:nlnetlabs:unbound:1.23.1
Nlnetlabs » Unbound » Version: 1.24.0

cpe:2.3:a:nlnetlabs:unbound:1.24.0
Nlnetlabs » Unbound » Version: 1.24.1

cpe:2.3:a:nlnetlabs:unbound:1.24.1
Nlnetlabs » Unbound » Version: 1.24.2

cpe:2.3:a:nlnetlabs:unbound:1.24.2
Nlnetlabs » Unbound » Version: 1.25.0

cpe:2.3:a:nlnetlabs:unbound:1.25.0
Nlnetlabs » Unbound » Version: 1.25.1

cpe:2.3:a:nlnetlabs:unbound:1.25.1
Nlnetlabs » Unbound » Version: 1.7.0

cpe:2.3:a:nlnetlabs:unbound:1.7.0
Nlnetlabs » Unbound » Version: 1.7.1

cpe:2.3:a:nlnetlabs:unbound:1.7.1
Nlnetlabs » Unbound » Version: 1.7.2

cpe:2.3:a:nlnetlabs:unbound:1.7.2
Nlnetlabs » Unbound » Version: 1.7.3

cpe:2.3:a:nlnetlabs:unbound:1.7.3
Nlnetlabs » Unbound » Version: 1.8.0

cpe:2.3:a:nlnetlabs:unbound:1.8.0
Nlnetlabs » Unbound » Version: 1.8.1

cpe:2.3:a:nlnetlabs:unbound:1.8.1
Nlnetlabs » Unbound » Version: 1.8.2

cpe:2.3:a:nlnetlabs:unbound:1.8.2
Nlnetlabs » Unbound » Version: 1.8.3

cpe:2.3:a:nlnetlabs:unbound:1.8.3
Nlnetlabs » Unbound » Version: 1.9.0

cpe:2.3:a:nlnetlabs:unbound:1.9.0
Nlnetlabs » Unbound » Version: 1.9.2

cpe:2.3:a:nlnetlabs:unbound:1.9.2
Nlnetlabs » Unbound » Version: 1.9.3

cpe:2.3:a:nlnetlabs:unbound:1.9.3
Nlnetlabs » Unbound » Version: 1.9.4

cpe:2.3:a:nlnetlabs:unbound:1.9.4
Nlnetlabs » Unbound » Version: 1.9.5

cpe:2.3:a:nlnetlabs:unbound:1.9.5
Nlnetlabs » Unbound » Version: 1.9.6

cpe:2.3:a:nlnetlabs:unbound:1.9.6

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-50248

Products

Pricing

Contact Us