Unbound NXDOMAIN denial for island trust anchor under insecure parent
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
NLnet Labs Unbound up to and including version 1.26.1 is affected when it is configured with both a root trust anchor and an additional trust-anchor for an island-of-security zone whose parent is provably insecure under the root chain. A malicious actor who can deliver one forged NXDOMAIN response for a name inside the island can make the validator use the root trust anchor instead, so the record is treated as insecure and its existence is denied. The flaw is classified as CWE-807, reliance on untrusted inputs in a security decision. The attacker needs network access to send the forged response, and the CVSS vector indicates high complexity and no privileges or user interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NLnet Labs | Unbound | before 1.26.2 | 1.26.2 | Patch available | CNA |
- Unbound VendorNLnet Labs Affected before 1.26.2 Fixed in 1.26.2 Patch available CNA
Remediation
Upgrade NLnet Labs Unbound to version 1.26.2 or later. The sources list no fix for other versions than 1.26.2.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA Unbound (NLnet Labs) Fixed in 1.26.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
NLnet Labs Unbound 1.26.2
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2026-78586 Unbound DoQ path migration use-after-free on multi-threaded deploymentsPriority LOW 39
- TI-2026-78584 Unbound resolver lacks aggregate limit on DNS compression pointersPriority LOW 30
- TI-2026-78614 Cache side-channel in NLnet Labs Unbound leaks upstream source portPriority LOW 23
Timeline
- 2026-10-21 Threatist record created from CVE-2026-50106
- 2026-10-21 Alias added: GHSA-pj55-6fvm-845h
- 2026-10-22 Priority changed: MEDIUM → LOW
- 2026-10-29 CISA SSVC decision points changed
References
More NLnet Labs vulnerabilities
- TI-2026-25690 Possible arbitrary code execution during DNSSEC validation CVSS 4.0CRITICAL 9.1
- TI-2026-56302 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY CVSS 4.0CRITICAL 9.1
- TI-2026-31146 Crash during DNSSEC validation of malicious content CVSS 4.0HIGH 8.7
- TI-2026-31135 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options CVSS 4.0HIGH 8.7
- TI-2026-36436 Routinator crashes on specifically crafted RRDP XML files CVSS 4.0HIGH 8.7
- TI-2026-36433 Routinator exits when accepting an incoming HTTP or RTR connection fails CVSS 4.0HIGH 8.7
Sources
- CVE-2026-50106 · CVE Program
- CVE-2026-50106 · NVD
- FIRST EPSS
- GHSA-pj55-6fvm-845h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences