NLnet Labs Unbound CVE-2026-44687

All five of the following conditions must be met simultaneously: (1) Unbound version 1.13.2 through 1.25.1 is the recursive resolver in use; (2) harden-below-nxdomain is enabled - this is the default configuration so no deliberate action is needed to be vulnerable; (3) a stub or forward zone is configured with an apex that is two or more labels below a DNSSEC-signed public zone (e.g., stub zone corp.internal.example.com where example.com is DNSSEC-signed and authoritative); (4) the resolver cache contains a DNSSEC-secure NXDOMAIN from the signed parent for the intermediate label (e.g., example.com has returned a signed NXDOMAIN for internal.example.com, which occurs naturally whenever no such delegation exists in the signed parent zone); (5) a DNS query is made specifically for the intermediate label between the stub/forward apex and the DNSSEC parent (e.g., a query for internal.example.com). What limits exploitation: attackers cannot trigger this against arbitrary targets - the private namespace topology and signed parent must already be in place; the impact is strictly availability (resolution fails) with no confidentiality or integrity loss; and the bug only fires on the specific intermediate-label query, not on arbitrary queries to the stub zone itself.

The vendor-assigned CVSS 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately characterizes this as a low-severity but network-reachable flaw. AC:H is warranted because exploitation demands a specific DNS topology - a stub/forward zone nested two or more labels under a DNSSEC-signed public parent - plus a pre-existing cached DNSSEC-secure NXDOMAIN for the intermediate label, a condition that occurs naturally in common enterprise deployments. No EPSS score was provided in the available data, and this vulnerability is not listed in the CISA KEV catalog. No public proof-of-concept has been identified. The 'Authentication Bypass' tag in the source data is misleading - this is a DNS configuration bypass affecting availability, not an authentication mechanism bypass. The most significant real-world risk is to organizations relying on Unbound for private namespace resolution where stub or forward zones are configured under signed public parent zones; in those environments the impact is silent DNS resolution failure, which may be difficult to attribute to this flaw without specific knowledge of the bug. Environments that do not use such nested private namespaces face no meaningful risk regardless of CVSS score.

In an enterprise using corp.internal.example.com as a stub zone in Unbound, where example.com is DNSSEC-signed and the resolver's cache holds a DNSSEC-secure NXDOMAIN for internal.example.com (populated by any prior legitimate query that returned no such delegation from example.com), a DNS query for internal.example.com triggers the off-by-one bug: the delegation guard passes at the stub apex, strips one more label, finds the cached signed NXDOMAIN for internal.example.com, and returns it, causing all subsequent queries to corp.internal.example.com to silently fail without ever contacting the stub upstream. No public proof-of-concept has been identified at time of analysis, and the AC:H rating reflects that this cache state arises naturally in typical deployments rather than requiring adversarial setup.