NLnet Labs Unbound up to 1.25.1 NSEC RRSIG.Labels injection

Summaryinfo

A vulnerability was found in NLnet Labs Unbound up to 1.25.1 and classified as very critical. Affected by this vulnerability is an unknown functionality of the component NSEC Handler. Such manipulation of the argument RRSIG.Labels leads to injection. This vulnerability is documented as CVE-2026-44690. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in NLnet Labs Unbound up to 1.25.1 and classified as very critical. Affected by this issue is an unknown code of the component NSEC Handler. The manipulation of the argument RRSIG.Labels with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.

The advisory is shared for download at nlnetlabs.nl. This vulnerability is handled as CVE-2026-44690 since 06/22/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/22/2026). The MITRE ATT&CK project declares the attack technique as T1055.

Upgrading to version 1.25.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• NLnet Labs

Name

• Unbound

Version

• 1.25.0
• 1.25.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion