Improper Verification of Cryptographic Signature in Unbound - CVE-2026-50106
Published: October 21, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass DNSSEC validation and deny resolution of records within an island-of-security zone.
The vulnerability exists due to improper verification of DNSSEC signatures in Unbound's validator when processing denial-of-existence responses for an island-of-security zone configured with an additional trust anchor alongside a root trust anchor, where the zone's parent is provably insecure under the root chain. A remote attacker can deliver a single forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG SignerName set to the insecure parent, to make the validator use the root trust anchor and then the insecure parent, incorrectly accepting the denial of existence as insecure.