Local Zones Tree Creation Flaw in Unbound by NLnet Labs
CVE-2026-55708

3.1LOW

Key Information:

Vendor

Nlnet Labs

Status
Unbound
Vendor
CVE Published:
22 July 2026

What is CVE-2026-55708?

In NLnet Labs Unbound versions 1.6.0 through 1.25.1, a vulnerability exists within the 'unbound-control' utility's commands 'view_local_data' and 'view_local_datas'. When a named view is configured without initial local data, the control interface creates a bare local zones tree that inadvertently omits crucial default-protected zones such as RFC 1918 reverse mappings, AS112 zones, and specific internal domains (.onion, .localhost). This omission leads to potential security lapses where queries for these default-protected names are forwarded to the public DNS, undermining local policy expectations and potentially exposing users to external threats.

Affected Version(s)

Unbound 1.6.0 < 1.25.2

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55708...
vendor-advisory

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qifan Zhang (Palo Alto Networks)
.