What’s Vulnerable › Vulnerabilities
CVE-2026-77955: Possible ZONEMD verification bypass window
- Severity: medium (CVSS 4.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-23
- Weakness: CWE-345
Description
In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.
Affected products
- NLnet Labs Unbound: from 1.13.2 before 1.26.1 — fixed in 1.26.1
How to fix
Upgrade to a fixed version: NLnet Labs Unbound 1.26.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-77955 or the next vulnerability affects your stack