CVE-2026-44687
Received Received - Intake

Stub Zone Bypass in Unbound DNSSEC Validation

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in 'harden-below-nxdomain' logic; enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is never contacted. 'harden-below-nxdomain' does an upward DNS cache walk together with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label. This results in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex's immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any private namespace nested two or more labels under a signed public name, the walk returns it and the configured stub/forward upstream is never contacted. This can only be triggered by the query for the intermediate label (between the stub/forward apex and the DNSSEC parent zone).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-44687
EUVD
EUVD-2026-47668

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-193 A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44687 is an off-by-one error in NLnet Labs Unbound DNS software versions 1.13.2 to 1.25.1. It affects the 'harden-below-nxdomain' logic, which is enabled by default. When querying a zone below an intermediate label under a DNSSEC-signed parent zone, the logic incorrectly performs an upward DNS cache walk. If the parent zone has a cached DNSSEC-secure NXDOMAIN response, the query bypasses the intended stub or forward zone and returns the cached NXDOMAIN instead.

Detection Guidance

To detect this vulnerability, check if your Unbound DNS server is running a vulnerable version (1.13.2 to 1.25.1). Run 'unbound -V' to check the version. If affected, queries for zones below an intermediate label under a DNSSEC-signed parent may bypass configured stub/forward zones.

Monitor DNS query logs for unexpected NXDOMAIN responses from parent zones when stub/forward zones should be contacted. Test with queries targeting the intermediate label between the stub/forward zone apex and the DNSSEC parent zone.

Impact Analysis

This vulnerability could cause DNS queries to fail or return incorrect results. Specifically, queries for zones below an intermediate label under a DNSSEC-signed parent zone may not reach the intended stub or forward zone. Instead, they may receive a cached NXDOMAIN response from the parent zone, effectively bypassing the configured DNS resolution.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to DNS resolution errors rather than data protection or privacy controls. However, if DNS resolution failures disrupt services handling sensitive data, it could indirectly impact compliance by causing service disruptions or misconfigurations.

Mitigation Strategies

Upgrade Unbound to version 1.25.2 or later immediately. If upgrading is not possible, apply the manual patch provided by NLnet Labs. Disable the 'harden-below-nxdomain' feature as a temporary workaround by setting 'harden-below-nxdomain: no' in the Unbound configuration file.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44687. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart