Skip to content
fr Sign in
4.4 Medium

CVE-2026-77955 In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check:…

Description

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.

Affected products and versions

Product Affected versions Fixed in
unbound 1.13 1.13.2 → < 1.26.1 1.26.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of unbound

The 58 CVEs of unbound →
CVE-2026-97206 NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable… 7.5 High CVE-2026-96405 NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual… 5.3 Medium CVE-2026-50106 When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional… 6.5 Medium CVE-2026-35501 When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an… 3.7 Low
Track this CVE