ALPINE-CVE-2026-55708
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.
ALPINE-CVE-2026-55708
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ALPINE-CVE-2026-55708
unbound
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.25.2-r0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
unbound
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.25.2-r0
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
unbound
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.25.2-r0
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.6.0"
},
{
"fixed": "1.25.2-r0"
}
]
}
],
"package": {
"name": "unbound",
"purl": "pkg:apk/alpine/unbound?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-55708.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.6.0"
},
{
"fixed": "1.25.2-r0"
}
]
}
],
"package": {
"name": "unbound",
"purl": "pkg:apk/alpine/unbound?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-55708.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.6.0"
},
{
"fixed": "1.25.2-r0"
}
]
}
],
"package": {
"name": "unbound",
"purl": "pkg:apk/alpine/unbound?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-55708.json"
},
"ecosystem_specific": {}
}
]Publisher severity
No explicit severity was provided.
- Event
- #54533 · Revision 1
- Added to Heist Feed
- Publisher date