{"id":"CVE-2026-35501","kind":"vulnerability","aliases":["CVE-2026-35501"],"related":[],"title":"Unbound: forged NSEC reply can mark a trust island as insecure","description":"When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC queries from clients when trust anchor for that name existed.","summary":"Unbound 1.0.1 through 1.26.1 accepts and caches a forged NSEC reply without validating its signature when a root trust anchor and an extra trust-anchor for an island-of-security zone are both configured. An attacker can use this to make Unbound treat that configured trust island as insecure, bypassing DNSSEC validation for it.","severity":"low","cvss":3.7,"epss":0.0011,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","dnssec","package","self-hosted","unbound"],"not_affected_if":["default-config","no-extra-trust-anchor"],"how_to_check":"- Run `unbound -V` to read the installed version and compare it to `1.26.1`.\n- Check the configuration for `trust-anchor:` entries alongside a root trust anchor, for example with `grep -rn trust-anchor /etc/unbound/`.","fix":"- Upgrade Unbound to a release newer than `1.26.1`; the sources do not name the exact fixed version, so check the NLnet Labs release notes.\n- If upgrading is not possible, remove the extra island-of-security `trust-anchor:` entry only if your design allows it (unknown whether this fully mitigates).","status":"open","published_at":"2026-10-21T09:17:07+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:43:35+00:00","updated_at":"2026-10-25T04:43:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:43:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Unbound to a release newer than `1.26.1`; the sources do not name the exact fixed version, so check the NLnet Labs release notes.\n- If upgrading is not possible, remove the extra island-of-security `trust-anchor:` entry only if your design allows it (unknown whether this fully mitigates).","reach":"network","title":"Unbound: forged NSEC reply can mark a trust island as insecure","impact":"low","summary":"Unbound 1.0.1 through 1.26.1 accepts and caches a forged NSEC reply without validating its signature when a root trust anchor and an extra trust-anchor for an island-of-security zone are both configured. An attacker can use this to make Unbound treat that configured trust island as insecure, bypassing DNSSEC validation for it.","category":"package","nicknames":[],"who_cares":["unbound","dns","dnssec","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker makes a configured DNSSEC trust island be treated as insecure","analyst_note":"Confirm the fixed version of Unbound after 1.26.1 from the NLnet Labs advisory or release notes; the sources do not name it.","how_to_check":"- Run `unbound -V` to read the installed version and compare it to `1.26.1`.\n- Check the configuration for `trust-anchor:` entries alongside a root trust anchor, for example with `grep -rn trust-anchor /etc/unbound/`.","needs_analyst":true,"not_affected_if":["default-config","no-extra-trust-anchor"],"who_is_affected":"Only resolvers running Unbound 1.0.1 through 1.26.1 with DNSSEC validation that have both a root trust anchor and an additional island-of-security trust anchor configured are affected. Resolvers without the extra trust-anchor, or running a version outside that range, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000693,"input_tokens":3507,"output_tokens":685,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-35501':14A,17A '1.0.1':26B,83C '1.26.1':28B,89C 'accept':29B,152C,171C 'actor':122C 'addit':100C 'allow':182C 'anchor':44B,50B,97C,103C,179C,198C 'apex':180C 'attack':62B 'bit':131C 'bypass':76B,159C 'cach':31B,154C 'chain':119C 'clear':132C 'client':195C 'configur':60B,71B,91C,139C 'cve':12A,15A 'dns':18B 'dnssec':19B,77B,148C 'ds':190C 'due':183C 'exist':202C 'extra':47B 'fix':187C 'forg':2A,33B,125C 'happen':145C 'host':23B 'includ':87C 'insecur':11A,75B,115C,143C,157C 'island':9A,54B,73B,107C,141C 'island-of-secur':53B,106C 'lab':81C 'make':67B 'malici':121C 'mark':6A 'name':201C 'nlnet':80C 'nsec':3A,34B,126C,156C,174C,192C 'old':186C 'packag':20B 'parent':112C 'provabl':114C 'queri':193C 'record':175C 'repli':4A,35B,127C 'respons':158C 'root':42B,95C,118C 'rrsig':161C 'secur':56B,109C 'self':22B 'self-host':21B 'signatur':39B 'soa':130C 'suppos':167C 'treat':69B,137C 'trick':134C 'trust':8A,43B,49B,72B,96C,102C,140C,178C,197C 'trust-anchor':48B,101C 'type':189C 'unbound':1A,24B,25B,68B,82C,135C,151C 'use':64B 'valid':37B,78B,149C,162C,165C 'version':88C 'whose':111C 'without':36B 'zone':57B,110C","nicknames":[],"mitigations":[],"who_affected":"Only resolvers running Unbound 1.0.1 through 1.26.1 with DNSSEC validation that have both a root trust anchor and an additional island-of-security trust anchor configured are affected. Resolvers without the extra trust-anchor, or running a version outside that range, can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"sep@nlnetlabs.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-35501","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35501","severity":null,"published_at":"2026-10-21T09:17:07+00:00","modified_at":"2026-10-22T15:22:40+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-35501","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35501","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}