CVE-2026-55708

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55708
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55708.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55708
Downstream
Related
Published
2026-07-22T14:17:21.403Z
Modified
2026-08-27T18:26:15.936848445Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.

References

Affected packages

Git / github.com/nlnetlabs/unbound

Affected ranges

Type
GIT
Repo
https://github.com/nlnetlabs/unbound
Events
Introduced
b0a1e50452c1945f3f040a9c9f5223b33d64d277
Fixed
c33ad1b1a21e48bfe4f140e90252a9be1b0c5745
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.6.0"
        },
        {
            "fixed": "1.25.2"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55708.json"