CVE-2026-35501
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to an old fix for type DS and NSEC queries from clients when trust anchor for that name existed.
Risk Assessment
This could lead to DNS response spoofing and redirection of traffic to malicious destinations, undermining trust in DNS resolution.
Recommendation
Update Unbound to a version later than 1.26.1 that includes the fix for this issue.
Other vulnerabilities in NLnet Labs Unbound
See all- CVE-2026-82717Critical
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce (rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow.
- CVE-2026-81634High
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation) can trigger the vulnerability.
- CVE-2026-55973High
Vulnerability in NLnet Labs Unbound (versions 1.23.0 to 1.25.1) with 'dns-error-reporting: yes' enabled allows an attacker to remotely crash the daemon by sending a crafted upstream response. The bug occurs when processing the EDNS Report-Channel option.
Original NVD description (English source)
When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC queries from clients when trust anchor for that name existed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS