From: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Date: Wed, 22 Jul 2026 08:14:04 +0000 (+0200)
Subject: - Fix CVE-2026-50243, 'response-ip'/'rpz' can rewrite BOGUS answers
X-Git-Tag: release-1.25.2~13
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=02b16de1ae40e43a3e3804e98ab9868da33d72eb;p=thirdparty%2Funbound.git

- Fix CVE-2026-50243, 'response-ip'/'rpz' can rewrite BOGUS answers
  instead of returning SERVFAIL. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
---

diff --git a/respip/respip.c b/respip/respip.c
index ff12114de..0a7dedd07 100644
--- a/respip/respip.c
+++ b/respip/respip.c
@@ -1114,7 +1114,13 @@ respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
 		if((qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
 			qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA ||
 			qstate->qinfo.qtype == LDNS_RR_TYPE_ANY) &&
-			qstate->return_msg && qstate->return_msg->rep) {
+			qstate->return_msg && qstate->return_msg->rep &&
+			!(qstate->env->need_to_validate &&
+			  (!(qstate->query_flags & BIT_CD)
+			    || qstate->env->cfg->ignore_cd) &&
+			  (qstate->return_msg->rep->security <= sec_status_bogus
+			    || qstate->return_msg->rep->security ==
+			    sec_status_secure_sentinel_fail))) {
 			struct reply_info* new_rep = qstate->return_msg->rep;
 			struct ub_packed_rrset_key* alias_rrset = NULL;
 			struct respip_action_info actinfo = {0, 0, 0, 0, NULL, 0, NULL};