Live › vulnerability › CVE-2026-35501
Go to dashboardUnbound 1.0.1 through 1.26.1 accepts and caches a forged NSEC reply without validating its signature when a root trust anchor and an extra trust-anchor for an island-of-security zone are both configured. An attacker can use this to make Unbound treat that configured trust island as insecure, bypassing DNSSEC validation for it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only resolvers running Unbound 1.0.1 through 1.26.1 with DNSSEC validation that have both a root trust anchor and an additional island-of-security trust anchor configured are affected. Resolvers without the extra trust-anchor, or running a version outside that range, can skip this.
No product ranges from the sources yet.
unbound -V to read the installed version and compare it to 1.26.1.trust-anchor: entries alongside a root trust anchor, for example with grep -rn trust-anchor /etc/unbound/.1.26.1; the sources do not name the exact fixed version, so check the NLnet Labs release notes.trust-anchor: entry only if your design allows it (unknown whether this fully mitigates).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC queries from clients when trust anchor for that name existed.
This page as .md · .json · in your agent: get_signal("CVE-2026-35501")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.