Log in Start free

Vulnerability · Published Sep 16, 2026 · Assigned by NLnet Labs

CVE-2026-77955Possible ZONEMD verification bypass window

Medium 4.4

In plain English

A medium-severity insufficient verification of data authenticity in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.2%top 93.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12unboundno fix listedDEBIAN-CVE-2026-77955
Debian:13unbound1.26.1-0+deb13u1DEBIAN-CVE-2026-77955
Debian:14unbound1.26.1-1DEBIAN-CVE-2026-77955
Ubuntu:22.04:LTSunboundno fix listedUBUNTU-CVE-2026-77955
Ubuntu:24.04:LTSunboundno fix listedUBUNTU-CVE-2026-77955
Ubuntu:26.04:LTSunboundno fix listedUBUNTU-CVE-2026-77955
Ubuntu:26.10unboundno fix listedUBUNTU-CVE-2026-77955

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound 1.13.2 – before 1.26.1

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

References