DNSSEC Vulnerability in NLnet Labs Unbound Affecting Version Range 1.0.1 to 1.26.1
CVE-2026-35501

3.7LOW

Key Information:

Vendor

Nlnet Labs

Status
Unbound
Vendor
CVE Published:
21 October 2026

What is CVE-2026-35501?

The vulnerability in NLnet Labs Unbound versions 1.0.1 through 1.26.1 stems from improper handling of DNSSEC validation. When both a root trust anchor and an additional trust anchor for an insecure zone are defined, a malicious actor can exploit this by sending a forged NSEC reply with the SOA bit cleared. As a result, Unbound incorrectly treats the trust anchor's zone as insecure, leading to potential security risks. This occurs because the DNSSEC validator fails to validate the RRSIG signatures and instead accepts the insecure response, undermining the trust model of DNS security.

Affected Version(s)

Unbound 1.0.1 < 1.26.2

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-35501...
vendor-advisory

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qifan Zhang (Palo Alto Networks)
.