What is the CVSS score of CVE-2026-44687?

CVE-2026-44687 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-44687?

Yes, a patch is available for CVE-2026-44687. Update the affected software to the latest version immediately.

NLnet Labs Unbound CVE-2026-44687

EUVD-2026-47668 LOW

Off-by-one Error (CWE-193)

2026-07-22 NLnet Labs

GHSA-x324-pxwv-r76h

Authentication Bypass Unbound

3.7

CVSS 3.1 · Vendor: NLnet Labs

Severity by source

Vendor (NLnet Labs) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.7 LOW

Requires specific cached DNSSEC-secure NXDOMAIN and namespace topology (AC:H); no credentials needed; impact is limited to availability as resolution silently fails with no data exposure.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 13:51 vuln.today

DescriptionCVE.org

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in 'harden-below-nxdomain' logic; enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is never contacted. 'harden-below-nxdomain' does an upward DNS cache walk together with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label. This results in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex's immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any private namespace nested two or more labels under a signed public name, the walk returns it and the configured stub/forward upstream is never contacted. This can only be triggered by the query for the intermediate label (between the stub/forward apex and the DNSSEC parent zone).

AnalysisAI

DNS stub and forward zone resolution in NLnet Labs Unbound 1.13.2 through 1.25.1 is silently bypassed due to an off-by-one error in the default-enabled harden-below-nxdomain feature. When a configured stub or forward zone apex is nested two or more labels beneath a DNSSEC-signed public zone and the resolver cache holds a DNSSEC-secure NXDOMAIN for the intermediate label, the guard logic walks one label too far, causing the stub/forward upstream to be permanently shadowed without error. No public exploit has been identified at time of analysis and CVSS 3.7 with AC:H reflects the narrow but realistic conditions common in enterprise private namespace deployments.

Technical ContextAI

Unbound is a validating, recursive, and caching DNS resolver developed by NLnet Labs, deployed extensively in enterprise, ISP, and government environments. The harden-below-nxdomain feature - enabled by default - performs an upward DNS cache walk with a delegation point guard intended to prevent NXDOMAIN synthesis above configured stub or forward zone apexes, protecting private namespace integrity. The root cause is CWE-193 (Off-by-One Error): the guard tests the domain name against the stub/forward apex before stripping a label rather than after. This creates a rogue iteration where the domain equals the configured apex, passes the guard, strips one additional label, and then probes the cache at the apex's immediate public parent. If that parent holds a cached DNSSEC-secure NXDOMAIN for the intermediate label - a predictable condition for any private namespace like corp.internal.example.com nested under a signed example.com - the walk returns that negative answer and the configured stub/forward upstream is never queried. Affected CPE: cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:* spanning versions 1.13.2 through 1.25.1.

RemediationAI

Upgrade NLnet Labs Unbound to a version beyond 1.25.1; the exact patched release number is not confirmed in the available data and operators should consult the vendor advisory directly at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44687.txt for the specific fix version before upgrading. As a configuration-level workaround, set harden-below-nxdomain: no in the Unbound configuration - this immediately eliminates the trigger condition but removes the DNSSEC negative-answer hardening protection that the feature provides, potentially exposing the resolver to other NXDOMAIN-related attacks; weigh this trade-off carefully in DNSSEC-validating environments. A structural workaround is to redesign the private namespace so that stub or forward zone apexes are not two or more labels beneath a DNSSEC-signed public zone (e.g., move from corp.internal.example.com to corp.internal.example under a separate non-signed TLD or to a single label below the signed parent), eliminating the topology that triggers the off-by-one walk; this approach requires DNS infrastructure changes but preserves harden-below-nxdomain functionality.