Use-after-free in Unbound - CVE-2026-52863
Published: July 23, 2026
Vulnerability identifier: #VU139226
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-52863
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to memory corruption in the view name handling for subqueries when processing queries that combine respip or rpz with a module that can attach subqueries under pressure. A remote attacker can send queries that trigger subquery processing and query jostling to cause memory corruption.
Exploitation requires Unbound to be configured with access-control-view together with respip or rpz and a module such as dns64, subnetcache, or respip CNAME redirection, and the issue occurs when slow queries are dropped under pressure.
Affected software
Unbound
Debian Linux
Fedora
unbound
unbound (Debian package)
Debian Linux
Fedora
unbound
unbound (Debian package)
How to mitigate CVE-2026-52863
Install security update from vendor's website.
Unbound - update to 1.25.2
unbound - update to 1.25.2-1.fc43
unbound (Debian package) - update to 1.26.1-0+deb13u1
unbound - update to 1.25.2-1.fc43
unbound (Debian package) - update to 1.26.1-0+deb13u1