CVE-2026-44690 in Unbound
Summary
by MITRE • 07/22/2026
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within NLnet Labs Unbound DNS resolver versions 1.7.0 through 1.25.1 and represents a critical cache poisoning flaw that exploits weaknesses in the handling of RRSIG.Labels field validation during aggressive NSEC processing as defined in RFC 8198. The core issue stems from insufficient input validation of the RRSIG.Labels field combined with premature cache writes that occur during the processing of NSEC records, creating an exploitable condition where a single malicious delegated zone can compromise sibling zones under the same NSEC-signed parent domain.
The technical flaw manifests through a combination of two critical weaknesses: first, the inadequate validation of the RRSIG.Labels field allows malformed or unexpected label counts to pass through without proper verification, and second, the premature cache writing during aggressive NSEC processing creates opportunities for malicious data to be stored before proper validation occurs. This vulnerability aligns with CWE-248, which addresses the exposure of uninitialized variables, and CWE-1236, concerning improper input validation in security-critical code paths. The attack vector leverages the DNS security model where a malicious actor controlling one delegated zone can manipulate the NSEC chain to affect other sibling zones that share the same parent domain structure.
The operational impact of this vulnerability is severe as it enables a single malicious domain owner to poison DNS caches for arbitrary sibling domains under NSEC-signed parent zones, effectively allowing them to inject insecure wildcard records and redirect traffic. This creates a pathway for DNS hijacking where legitimate delegations that don't exist in the parent zone can be brought into insecure existence through fraudulent wildcard DS records with fewer labels than expected and unknown algorithms. The malicious actor can exploit this to create false delegation records that appear legitimate within the NSEC chain, allowing them to inject malicious DNS responses for domains that should remain secure under normal circumstances.
The attack pattern follows a specific sequence where the malicious actor first establishes control over one delegated zone under an NSEC-signed TLD, then uses the cache poisoning vulnerability to manipulate the parent zone's NSEC records. This manipulation enables the injection of insecure wildcard DS records that can bring non-existent delegations into existence, effectively allowing the attacker to create false authoritative records for domains that never existed in the legitimate DNS hierarchy. Mitigation strategies should include immediate upgrading to patched versions of Unbound, implementing proper RRSIG.Labels field validation, and disabling aggressive NSEC processing where possible. This vulnerability demonstrates the critical importance of proper input validation in security-sensitive applications and aligns with ATT&CK technique T1499.004 for network denial of service through cache poisoning attacks. Organizations should also consider implementing DNS monitoring systems to detect anomalous NSEC record patterns and ensure proper validation of all DNS security-related fields before cache storage operations occur.
The broader implications extend beyond simple cache poisoning as this vulnerability exposes fundamental weaknesses in how DNS resolvers handle security-related metadata during cache operations. The combination of insufficient validation and premature cache writes creates a dangerous condition where trust boundaries can be violated through seemingly innocuous DNS responses. This type of vulnerability is particularly concerning because it allows for lateral movement within DNS hierarchies, enabling attackers to compromise multiple domains simultaneously through a single point of entry. The vulnerability's impact is amplified by its ability to affect arbitrary sibling zones rather than being limited to direct parent-child relationships, making it significantly more dangerous in complex DNS environments with numerous delegated zones under shared parent domains.