Cross-zone wildcard cache poisoning in Unbound (CVE-2026-44690)

Insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning in Unbound. A malicious actor controlling a single delegated zone can poison arbitrary sibling zones under NSEC-signed parent domains, allowing injection of insecure wildcard records for non-existent delegations. Affected versions: - 1.7.0 - 1.25.1 We recommend updating to: 1.25.2. CVSS 7.5 · our assessment: this_week Reference: https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44690.txt Details: https://vuln.today/cve/CVE-2026-44690