Unbound 1.10.0-1.25.1 serve-expired-client-timeout Null Ptr Crash via response-ip
CVE-2026-55717 Published on July 22, 2026
'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash
In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of 'serve-expired-client-timeout' is taken leading to denial of service via the server crash.
Timeline
Issue reported by Qifan Zhang
Issue reported by Xin Wang 22 days later.
NLnet Labs shares patch with Xin Wang
Xin Wang verifies patch
NLnet Labs shares patch with Qifan Zhang 2 days later.
Qifan Zhang verifies patch 5 days later.
Fixes released with version 1.25.2 49 days later.
Weakness Type
NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.
Products Associated with CVE-2026-55717
Want to know whenever a new CVE is published for Nlnetlabs Unbound? stack.watch will email you.
Affected Versions
NLnet Labs Unbound:- Version 1.10.0 and below 1.25.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.