MNBSD-2026-54: use-after-free and crash in RPZ code

Description

A use-after-free in the Response Policy Zone (RPZ) code can crash unbound (Denial of Service). Reported by Qifan Zhang, Palo Alto Networks.

Affected Versions

unbound

Recommendations

No specific recommendations provided.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-44608
• https://nlnetlabs.nl/projects/unbound/security-advisories/

Additional Information

Aliases: CVE-2026-44608

Published: June 11, 2026
Last Modified: June 11, 2026