CVE-2026-55717— 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NLnet Labs | Unbound | 1.10.0< 1.25.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55717
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash
Source: CVE Program / CVE List V5
Vulnerability Description
In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of 'serve-expired-client-timeout' is taken leading to denial of service via the server crash.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
NLnet Labs Unbound 异常处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NLnet Labs Unbound是荷兰NLnet Labs组织的域名系统解析服务器。 NLnet Labs Unbound 1.10.0版本至1.25.1版本存在异常处理不当漏洞，该漏洞源于'serve-expired-client-timeout'回调函数中'alias_rrset'重置但'partial_rep'未被重置，导致空指针取消引用和崩溃，可能被远程客户端利用，通过控制委派域并延迟过期记录的响应，最终导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NLnet Labs | Unbound | 1.10.0 ~ 1.25.2 | - |
II. Public POCs for CVE-2026-55717
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55717
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-55717 (1)
Same Patch Batch · NLnet Labs · 2026-07-22 · 24 CVEs total
| CVE-2026-55973 | 7.5 HIGH | 'dns-error-reporting: yes' leads to stack buffer overflow |
| CVE-2026-44690 | 7.5 HIGH | Cross-zone wildcard cache poisoning via RRSIG.labels manipulation |
| CVE-2026-32665 | 7.5 HIGH | Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass |
| CVE-2026-40691 | 7.5 HIGH | Packet of death for DNSCrypt over TCP |
| CVE-2026-50248 | 6.5 MEDIUM | BOGUS configured primary hostname accepted for XFR in auth/rpz zones |
| CVE-2026-50046 | 5.9 MEDIUM | Possible heap use-after-free in an error path when a DoT forwarded query is jostled out |
| CVE-2026-55991 | 5.9 MEDIUM | Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 |
| CVE-2026-55990 | 5.9 MEDIUM | Packet of death for a DNSCrypt misconfigured Unbound |
| CVE-2026-56444 | 5.9 MEDIUM | Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout |
| CVE-2026-44621 | 5.9 MEDIUM | Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abr |
| CVE-2026-52863 | 5.9 MEDIUM | Memory corruption could lead to crash and denial of service |
| CVE-2026-14586 | 5.9 MEDIUM | Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments |
| CVE-2026-50251 | 5.3 MEDIUM | Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush |
| CVE-2026-50045 | 5.3 MEDIUM | 'max-global-quota' reset by DNSSEC validation restarts |
| CVE-2026-56416 | 4.8 MEDIUM | Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name |
| CVE-2026-42955 | 3.7 LOW | Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-tim |
| CVE-2026-54478 | 3.7 LOW | DNS Cookie bypass when combined with proxy-protocol use |
| CVE-2026-44687 | 3.7 LOW | Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legi |
| CVE-2026-46582 | 3.7 LOW | A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply |
| CVE-2026-41637 | 3.7 LOW | Degradation of resolution service from improperly accounted client-terminated DNS-over-QUI |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Unbound
- CVE-2026-56444
Degradation of resolution service when 'discard-timeout' and - CVE-2026-56416
Possible heap buffer overflow when validator canonicalizes R - CVE-2026-55991
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in - CVE-2026-55990
Packet of death for a DNSCrypt misconfigured Unbound - CVE-2026-55973
'dns-error-reporting: yes' leads to stack buffer overflow
Same vendor: NLnet Labs
- CVE-2026-56444
Degradation of resolution service when 'discard-timeout' and - CVE-2026-56416
Possible heap buffer overflow when validator canonicalizes R - CVE-2026-55991
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in - CVE-2026-55990
Packet of death for a DNSCrypt misconfigured Unbound - CVE-2026-55973
'dns-error-reporting: yes' leads to stack buffer overflow
Same weakness: CWE-476
- CVE-2026-67184
TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTT - CVE-2026-47427
GitHub MCP Server: Nil Pointer Dereference DoS in completion - CVE-2026-66749
Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Derefere - CVE-2026-17500
ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern - CVE-2026-45816
Apache NimBLE: NULL pointer dereference vulnerability in SMP
V. Comments for CVE-2026-55717
No comments yet