Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
NLnet Labs patched a critical heap overflow (CVE-2026-81642) in Unbound's DNSSEC validator that a malicious DNS zone can trigger for possible RCE.
68
CVE-2026-77955
Tampered Zone Data Served Before ZONEMD Verification in NLnet Labs Unbound
- CVSS 3.1
- 4.4 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
NLnet Labs Unbound versions 1.13.2 through 1.26.1 contain a data-authenticity flaw (CWE-345) in the ZONEMD integrity check for configured zones (zonemd-check set to yes) that sit below, but not at, a DNSSEC trust anchor. Because the DS/DNSKEY lookups required for ZONEMD validation happen asynchronously, there is an attack window in which tampered zone contents are served to clients or written to a configured zonefile before verification completes; if such a zonefile is written while the check failed, the tampered data are reloaded on startup and served until verification concludes again, and even after a failed check the data persist on disk for future reloads. An attacker positioned to tamper with the zone source data can therefore have bogus DNS records accepted by clients, yielding high integrity impact but no confidentiality or availability impact; the official CVSS 3.1 score is 4.4 medium (AV:N/AC:H/PR:H/UI:N). Only operators running Unbound authoritative-style (auth-zone) configurations with ZONEMD checking enabled for subordinate zones are affected. No public proof-of-concept or known exploitation exists, and although one headline calls it a critical RCE flaw, the vendor's own scoring describes an integrity issue, not code execution.
What to do: Upgrade all Unbound instances to a release newer than 1.26.1, per NLnet Labs' advisory for CVE-2026-77955. As an interim mitigation, disable ZONEMD checking (set zonemd-check to no) for zones below a trust anchor, and audit any configured zonefiles for tampered data written during failed verification, deleting them so they are not reloaded at startup.
| Product | Affected |
|---|---|
| NLnet Labs Unbound | 1.13.2 up to and including 1.26.1 |
Estimated exposure
nichelikely only hundreds to low thousands of resolver deployments worldwide (precise count unknown) — Unbound has a very large install base (millions of servers, appliances, and *BSD/distro packages), but the flaw requires the uncommon auth-zone configuration with ZONEMD checking enabled for zones below a trust anchor, for which no public…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.