This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-50248 →
ALPINE-CVE-2026-50248
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is s...
Original description
The description as published by the source.
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary and can replaces the entire zone/the resolver's entire response policy.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.22
unbound
[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.25.2-r0"}]}]
Alpine:v3.23
unbound
[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.25.2-r0"}]}]
Alpine:v3.24
unbound
[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.25.2-r0"}]}]
References
- advisory security.alpinelinux.org