CVE-2026-44690
published 2026-07-22CVE-2026-44690: In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.14%
3.2th percentile
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nlnet_labs | unbound | >= 1.7.0 < 1.25.2 | 1.25.2 |
| nlnetlabs | unbound | — | — |
| nlnetlabs | unbound | >= 1.7.0 < 1.25.2 | 1.25.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
NLnet Labs Unbound up to 1.25.1 NSEC RRSIG.Labels injection (Nessus ID 337342 / WID-SEC-2026-2492)
vuldb·2026-08-18·CVSS 7.5
CVE-2026-44690 [HIGH] NLnet Labs Unbound up to 1.25.1 NSEC RRSIG.Labels injection (Nessus ID 337342 / WID-SEC-2026-2492)
A vulnerability has been found in NLnet Labs Unbound up to 1.25.1 and classified as very critical. Affected is an unknown function of the component NSEC Handler. This manipulation of the argument RRSIG.Labels causes injection.
This vulnerability is registered as CVE-2026-44690. Remote exploitation of the attack is possible. No exploit is available.
The affected component should be upgraded.
GHSA
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache
ghsa_unreviewed·2026-07-22
CVE-2026-44690 [HIGH] CWE-345 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the m
Red Hat
unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes
vendor_redhat·2026-07-22·CVSS 7.5
CVE-2026-44690 [HIGH] unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes
unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes
A flaw was found in Unbound. Insufficient validation of the RRSIG.Labels field, combined with premature cache writes during RFC 8198 aggressive NSEC processing, can lead to cache poisoning. This vulnerability allows a malicious actor, controlling a single delegated zone, to poison arbitrary sibling zones under NSEC-signed parent domains. The primary impact is the integrity of DNS resolution, potentially leading to users being directed to malicious websites or services.
Statement: This Important flaw in Unbound allows a remote attacker to perform DNS cache poisoning. By controlling a delegated zone, a malicious actor can manipulate DNS resolution for arbitrary sibling zones under NSEC-sig
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-44690 unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes [fedora-all]
bugzilla·2026-07-27·CVSS 7.5
CVE-2026-44690 [HIGH] CVE-2026-44690 unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes [fedora-all]
CVE-2026-44690 unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison
arbitrary sibling zones under NSEC-signed parent domains. Unbound 1.25.2 includes fixes to add lower-bound check in RRSIG labels, move cache write stricly after validation and adding bailiwick check when updating
Bugzilla
CVE-2026-44690 unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes
bugzilla·2026-07-20·CVSS 7.5
CVE-2026-44690 [HIGH] CVE-2026-44690 unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes
CVE-2026-44690 unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes
Insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison
arbitrary sibling zones under NSEC-signed parent domains. Unbound 1.25.2 includes fixes to add lower-bound check in RRSIG labels, move cache write stricly after validation and adding bailiwick check when updating wildcards.
2026-07-22
Published