CVE-2026-52863 Details

A memory corruption vulnerability has been identified in NLnet Labs Unbound versions 1.25.0 through 1.25.1. The issue arises from a fix that allows the 'respip' and 'dns64' modules to work together, which creates a shallow copy of the view name. If the original view name's owner is displaced while Unbound is under load, this can lead to memory corruption. The vulnerability requires Unbound to be configured with either the 'respip' or 'rpz' modules, along with a module that can attach subqueries (such as 'respip' CNAME redirection, 'dns64', or 'subnetcache') and a configured 'access-control-view'. The issue is triggered under pressure when the jostle logic activates and begins dropping slow queries, causing the subquery to receive a shallow copy of the view name. If the super query, which owns the view name, is jostled out, memory corruption can occur. Although the likelihood of a crash is low—since it depends on the memory allocator and layout—debug memory builds (like ASAN) that detect the free will terminate the server.

Users can upgrade to Unbound version 1.25.2, which includes the necessary fix. Alternatively, for those using Unbound 1.25.1, a patch is available that addresses this vulnerability. This patch can be applied manually by downloading it, applying it to the Unbound source directory, and then running 'make install'.