Insufficient Validation in NLnet Labs Unbound DNS Resolver

CVE-2026-44690

What is CVE-2026-44690?

In NLnet Labs Unbound DNS resolver versions 1.7.0 through 1.25.1, a security weakness exists that stems from inadequate validation of the RRSIG.Labels field. This flaw, coupled with premature cache writes during aggressive NSEC processing as defined in RFC 8198, allows for cache poisoning attacks. Malicious actors controlling a single delegated zone can exploit this vulnerability to inject arbitrary insecure DNS responses for unrelated sibling zones within NSEC-signed parent domains. This risky behavior enables attackers with mere control of one registered domain under an NSEC-signed top-level domain to manipulate DNS records, leading to potential risks for other domains sharing the same parent zone.

References