DEBIAN-CVE-2026-55708

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-55708
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55708.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-55708
Upstream
Published
2026-07-22T14:17:21Z
Modified
2026-09-19T16:00:09Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.

References

Affected packages

Debian:12 / unbound

Package

Name
unbound
Purl
pkg:deb/debian/unbound?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.17.1-2
1.17.1-2+deb12u1
1.17.1-2+deb12u2
1.17.1-2+deb12u3
1.17.1-2+deb12u4
1.17.1-2+loong64
1.18.0-1
1.18.0-2
1.19.1-1
1.19.2-1
1.20.0-1
1.21.1-1
1.22.0-1
1.22.0-2
1.23.1-1
1.24.0-1
1.24.0-2
1.24.1-1
1.24.1-2
1.24.2-1
1.25.0-1
1.25.1-1
1.25.2-1
1.26.0-1
1.26.0-2
1.26.1-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55708.json"

Debian:13 / unbound

Package

Name
unbound
Purl
pkg:deb/debian/unbound?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.26.1-0+deb13u1

Affected versions

1.*
1.22.0-2
1.22.0-2+deb13u1
1.22.0-2+deb13u2
1.22.0-2+deb13u3
1.23.1-1
1.24.0-1
1.24.0-2
1.24.1-1
1.24.1-2
1.24.2-1
1.25.0-1
1.25.1-1
1.25.2-1
1.26.0-1
1.26.0-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55708.json"

Debian:14 / unbound

Package

Name
unbound
Purl
pkg:deb/debian/unbound?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.25.2-1

Affected versions

1.*
1.22.0-2
1.23.1-1
1.24.0-1
1.24.0-2
1.24.1-1
1.24.1-2
1.24.2-1
1.25.0-1
1.25.1-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55708.json"