The CVE number for this vulnerability is CVE-2026-44690.

A multi-vendor cross-zone wildcard cache poisoning vulnerability has been
dicsovered in DNSSEC caching resolvers.

Unbound is vulnerable as well when using 'aggressive-nsec'.


== Summary
Insufficient validation of the RRSIG.Labels field combined with premature cache
writes during RFC 8198 aggressive NSEC processing leads to cache poisoning
that permits a malicious actor controlling a single delegated zone to poison
arbitrary sibling zones under NSEC-signed parent domains.

Unbound 1.25.2 includes fixes to add lower-bound check in RRSIG labels, move
cache write stricly after validation and adding bailiwick check when updating
wildcards.


== Affected products
Unbound 1.7.0 up to and including version 1.25.1.


== Description
A malicious actor with one registered domain under an NSEC-signed TLD can serve
malicious insecure DNS responses for unrelated sibling domains (sharing the
same parent zone).
Arbitrary delegations that do not exist under the parent domain and are covered
by the parent's NSEC chain can be brought into insecure existence by fraudulent
wildcard DS records (less labels than expected, unknown algorithm) from the
malicious sibling domain.
This allows the malicious actor to inject insecure wildcard records for those
delegations.

Unbound 1.25.2 includes fixes to add lower-bound check in RRSIG labels, move
cache write stricly after validation and adding bailiwick check when updating
wildcards.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-44690.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-44690.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.