Unbound CVE-2026-35501

Exploitation requires a specific, non-default Unbound configuration: the resolver must be set up with BOTH a root trust anchor AND an additional 'trust-anchor:' entry for an island-of-security zone whose parent is provably insecure under the root chain. Given that, the attacker must deliver a forged NSEC reply with the SOA bit cleared at the trust-anchor apex, which Unbound then accepts and caches without the required RRSIG validation. Limiting factors: the vulnerable island-of-security trust-anchor configuration is uncommon rather than default; the attacker needs the ability to inject/spoof DNS responses (implying an on-path or response-spoofing capability, reflected in AC:H); and impact is confined to downgrading the affected trust island to insecure (integrity-only, no data disclosure or denial of service). Affected versions are Unbound 1.0.1 through 1.26.1.

All signals point to this being a genuine but LOW-priority issue, consistent with its 3.7 CVSS base score. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) shows network reach and no privileges required, but high attack complexity and only a LOW integrity impact with no confidentiality or availability loss - the flaw lets an attacker downgrade a specific configured trust island from 'secure' to 'insecure', weakening DNSSEC protection rather than directly disclosing or destroying data. Exploitation status is 'no public exploit identified at time of analysis': the input provides no EPSS score, no CISA KEV listing, and no POC flag, so there is no evidence of active or automated exploitation. The high complexity is well justified: success requires a specific non-default Unbound configuration (an island-of-security trust-anchor under a provably-insecure parent) plus the ability to inject a forged NSEC reply with the SOA bit cleared, which typically implies an on-path/spoofing position. Net: a real, vendor-confirmed DNSSEC validation weakness, but narrow preconditions and low impact make it a patch-in-routine-maintenance item, not an emergency. Missing EPSS and the absence of KEV/POC data mean exploitation likelihood is inferred from the vector, not independently measured.

An on-path attacker (or one able to spoof DNS responses) targets an Unbound resolver that is configured with both a root trust anchor and an extra trust-anchor for an island-of-security zone whose parent is provably insecure. The attacker returns a forged NSEC record with the SOA bit cleared at the trust-anchor apex; Unbound accepts and caches it without performing the required RRSIG validation, causing it to treat the configured secure island as insecure. No public exploit code is identified at time of analysis.