CVE-2026-35501Low· 3.7▾ SunlitWhen NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malic…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
0.1% → 0.1%
When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC queries from clients when trust anchor for that name existed.
Unbound >= 1.0.1 < 1.26.2This issue is fixed starting with version 1.26.2
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109125Medium· 5.3Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'
CVE-2026-96405Medium· 5.3Aggregate DNS name chained pointer decompression work leads to degradation of service.
CVE-2026-50106Medium· 6.5Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.
CVE-2026-97206High· 7.5DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
CVE-2019-16866High· 7.5Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query
CVE-2026-55991Medium· 5.9Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2