- Fix CVE-2026-50251, Attacker supplied `0.0.0.0`/`::` glue triggers

  defensive full-cache flush. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.

diff --git a/doc/unbound.conf.rst b/doc/unbound.conf.rst
index cc01451cd4324d37ab5a36507731b4146f0cd49c..2e37e2e5d45daf06d952b09c1bff9e183d446ed7 100644 (file)
--- a/doc/unbound.conf.rst
+++ b/doc/unbound.conf.rst
@@ -2055,6 +2055,13 @@ These options are part of the ``server:`` section.
     flushing away any poison.
     A value of 10 million is suggested.
 
+    It is useful to add 0.0.0.0/8 and '::' to the
+    :ref:`do-not-query-address<unbound.conf.do-not-query-address>` list.
+    Otherwise they may be answered, from localhost, and the different source
+    makes an unwanted reply that unnecessarily ticks up.
+    The :ref:`do-not-query-localhost<unbound.conf.do-not-query-localhost>`
+    option includes them, the zero subnets, when it is enabled.
+
     Default: 0 (disabled)
 
 

diff --git a/iterator/iter_donotq.c b/iterator/iter_donotq.c
index 40ffb45c49aada200d93caba0889a231ede6d4de..7eecf1354f79f40c673a051ed41546838b49d555 100644 (file)
--- a/iterator/iter_donotq.c
+++ b/iterator/iter_donotq.c
@@ -132,6 +132,18 @@ donotq_apply_cfg(struct iter_donotq* dq, struct config_file* cfg)
                if(cfg->do_ip6) {
                        if(!donotq_str_cfg(dq, "::1"))
                                return 0;
+                       if(!donotq_str_cfg(dq, "::ffff:127.0.0.0/104"))
+                               return 0;
+               }
+               /* RFC 1122 3.2.1.3 / RFC 6890 / RFC 4291 2.5.2: not valid as
+                * destination; on Linux these route to the local host. */
+               if(!donotq_str_cfg(dq, "0.0.0.0/8"))
+                       return 0;
+               if(cfg->do_ip6) {
+                       if(!donotq_str_cfg(dq, "::"))
+                               return 0;
+                       if(!donotq_str_cfg(dq, "::ffff:0:0/96"))
+                               return 0;
                }
        }
        addr_tree_init_parents(&dq->tree);

diff --git a/testdata/dns_error_reporting.rpl b/testdata/dns_error_reporting.rpl
index f1fac12a228431735a58886674e7e6f1a67df4d9..22175caded1658d2ba4b0aacc867f9102474d1a6 100644 (file)
--- a/testdata/dns_error_reporting.rpl
+++ b/testdata/dns_error_reporting.rpl
@@ -12,6 +12,7 @@ server:
        ede: no  # It is not needed for dns-error-reporting; only for clients to receive EDEs
        dns-error-reporting: yes
        do-ip6: no
+       do-not-query-localhost: no
 
 stub-zone:
        name: domain