CVEFinder.io

CVE-2026-77955

đŸ”ļ medium
Summary

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check fai

Description

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.

CVSS Score
4.4
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-09-16
First Seen: 2026-09-18
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 11.4% of all 365,968 vulnerabilities in our database.

#324,375
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Sep 16, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
🏆 Discovered By
Yuqi Qiu (Nankai University, AOSP Lab) Xiang Li (Nankai University, AOSP Lab) Qifan Zhang (Palo Alto Networks)
SSVC data provided by CISA
Last Modified 2026-09-23
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
CWE IDs (Weakness Types)
CWE-345

đŸ“Ļ Affected Products 1

Vendor Product Status Affected Versions
nlnetlabs unbound Affected
> 1.13.2 < 1.26.1

🔗 References 1

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-...
Patch Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-77860 ℹī¸ low 3.7 0.3 In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a dou... 2026-09-16
CVE-2026-78227 đŸ”ļ medium 6.5 0.3 NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC... 2026-09-16
CVE-2026-80225 đŸ”ļ medium 5.3 0.5 In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT readin... 2026-09-16
CVE-2026-81634 ⚠ī¸ high 7.5 0.5 In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap b... 2026-09-16
CVE-2026-81642 ⛔ critical 9.8 1.0 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial ... 2026-09-16
CVE-2026-82717 ⛔ critical 9.8 0.8 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memor... 2026-09-16
These CVEs affect the same products