CVE-2026-44690
Received Received - Intake

Cache Poisoning in Unbound DNS Resolver

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-44690
EUVD
EUVD-2026-47669

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in NLnet Labs Unbound DNS resolver versions 1.7.0 to 1.25.1 allows cache poisoning through insufficient validation of the RRSIG.Labels field during aggressive NSEC processing. A malicious actor with control over one delegated zone can poison unrelated sibling zones under NSEC-signed parent domains by injecting fraudulent wildcard DS records. This creates insecure wildcard records for non-existent delegations covered by the parent's NSEC chain.

Detection Guidance

To detect this vulnerability, check if your Unbound resolver is running a vulnerable version (1.7.0 to 1.25.1) and if 'aggressive-nsec' is enabled. Run 'unbound -V' to check the version and 'unbound-control list_forwards' to inspect cache behavior. Monitor DNS logs for unexpected wildcard records or cache entries.

Impact Analysis

If you use an affected Unbound version, an attacker could redirect your DNS queries to malicious servers without your knowledge. This could lead to stolen credentials, phishing attacks, or interception of sensitive communications. The impact is limited to DNS resolution and does not directly compromise your system.

Compliance Impact

This vulnerability primarily affects DNS integrity rather than direct data exposure. However, it could indirectly impact compliance by enabling man-in-the-middle attacks that expose sensitive data during DNS resolution. Organizations must ensure DNSSEC validation and patch affected systems to maintain compliance with data protection standards.

Mitigation Strategies

Upgrade Unbound to version 1.25.2 or later. If upgrading is not possible, apply the manual patch for version 1.25.1. Disable 'aggressive-nsec' in the Unbound configuration file by setting 'aggressive-nsec: no' and restart the service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44690. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart