Input validation error in Unbound - CVE-2026-44690
Published: July 23, 2026
Vulnerability identifier: #VU139234
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2026-44690
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: NLnet Labs
Affected software:
Unbound
Unbound
Detailed vulnerability description
The vulnerability allows a remote attacker to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.
The vulnerability exists due to improper input validation in aggressive NSEC processing when processing malicious DNS responses containing fraudulent wildcard DS records and invalid RRSIG labels. A remote attacker can control a single delegated zone and serve crafted DNS responses to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.
Exploitation requires Unbound to be configured with aggressive-nsec and the attacker to control one registered domain under an NSEC-signed parent domain.
How to mitigate CVE-2026-44690
Install security update from vendor's website.