CVE-2026-35501

Awaiting Analysis Awaiting Analysis - Queue

DNSSEC Validation Bypass in Unbound DNS Resolver

Publication date: 2026-10-21

Last updated on: 2026-10-29

Assigner: NLnet Labs

Description

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC queries from clients when trust anchor for that name existed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-35501

EUVD

EUVD-2026-107151

Affected Vendors & Products

Vendor	Product	Version / Range
NLnet Labs	Unbound	1.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-354	The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

Executive Summary

CVE-2026-35501 is a DNSSEC validation flaw in Unbound DNS software versions 1.0.1 to 1.26.1. When configured with a root trust anchor and an additional trust anchor for an insecure zone, a malicious actor can send a forged NSEC reply with the SOA bit cleared. This tricks Unbound into treating the trust island as insecure by bypassing RRSIG validation. The issue arises from obsolete code handling DS and NSEC queries with existing trust anchors.

Detection Guidance

To detect this vulnerability, check the Unbound version running on your system. Run 'unbound -V' to see the version. If it is between 1.0.1 and 1.26.1, the system is vulnerable. Additionally, review Unbound configuration files for trust anchors and island-of-security zones.

Impact Analysis

An attacker could manipulate DNSSEC validation to make Unbound accept forged NSEC records, potentially redirecting users to malicious sites or intercepting traffic. This undermines DNSSEC's security benefits, allowing spoofed responses to go undetected. Systems relying on Unbound for DNSSEC validation may be exposed to cache poisoning or misrouted queries.

Compliance Impact

This vulnerability could impact compliance by failing to ensure DNSSEC integrity, which is often required for secure data transmission. GDPR and HIPAA mandate measures to protect data integrity and confidentiality. If DNSSEC validation is bypassed, organizations may not meet these requirements, risking non-compliance and potential data breaches.

Mitigation Strategies

Immediately upgrade Unbound to version 1.26.2 or later. If upgrading is not possible, apply the manual patch provided by NLnet Labs. Remove any unnecessary trust anchors and review DNSSEC configurations to ensure proper validation.

Hi! I’m here to help you understand CVE-2026-35501. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...