The CVE number for this vulnerability is CVE-2026-77955.


== Description
A vulnerability in ZONEMD configured zones (zonemd-check: yes) which are
located below (but not at) a trust anchor allow for an attack window where
(tampered with) zone contents are served (or stored to disk) prior to the
ZONEMD integrity check.
This is caused by the needed DS/DNSKEY asynchronous resolution that needs to
happen before the ZONEMD check completes.
If a zonefile is written to disk (zonefile: option) while the ZONEMD check
failed, the tampered data are reloaded on startup and available until ZONEMD
verification concludes again.
If verification fails, the data is not served any more but still persists on
disk for future reloads.

Unbound 1.26.1 includes a fix to ensure that a ZONEMD configured zone is only
available (in memory and on disk) when the ZONEMD check is completed.


== Affected products
Unbound 1.13.2 up to and including version 1.26.0.


== Mitigation

=== Downloading patched version
Unbound 1.26.1 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz

=== Applying the patch manually
For Unbound 1.26.0 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-77955_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-77955_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-77955.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.26.0.


== Acknowledgments
We would like to thank Yuqi Qiu and Xiang Li from Nankai University, AOSP
Lab, also Qifan Zhang from Palo Alto Networks for discovering and responsibly
disclosing the vulnerability.