Unbound CVE-2026-44690

Exploitation requires: (1) the attacker to control at least one legitimately registered delegated zone whose parent is signed with NSEC (not NSEC3); (2) the victim resolver to be Unbound 1.7.0-1.25.1 with RFC 8198 aggressive NSEC processing enabled (the 'aggressive-nsec' feature); and (3) the targeted sibling delegations to be covered by that parent's NSEC chain. The attack then abuses fraudulent wildcard DS records with fewer labels than expected and an unknown algorithm plus unvalidated RRSIG.Labels. Limiting factors: it only works against NSEC-signed parents (NSEC3-signed zones are not stated as affected), only affects sibling zones sharing the same parent as the attacker's domain, and depends on aggressive NSEC being active - disabling that feature removes the vector. No authentication to the resolver is needed (PR:N), and no user interaction is required.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) reflects a network-reachable, integrity-only impact with no confidentiality or availability loss - consistent with DNS spoofing rather than code execution, despite the 'Code Injection' tag which appears mislabeled. The vendor-assigned AC:L understates real complexity: successful exploitation requires the target resolver to have RFC 8198 aggressive NSEC processing active and the victim domains to sit under an NSEC-signed (not NSEC3) parent zone, plus the attacker must already control a registered sibling delegation - meaningful preconditions that argue for higher attack complexity in practice. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation; this is currently a credible-but-unexploited high-integrity risk. The genuine severity driver is scope of abuse: one cheap registered domain can poison arbitrary sibling zones, which for a shared recursive resolver (ISP/enterprise) can affect many downstream clients. Missing data: exact fixed version and EPSS are not in the input and should be confirmed against the NLnet Labs advisory.

An attacker registers one cheap domain under an NSEC-signed TLD, then stands up an authoritative server that returns crafted wildcard DS records (fewer labels than expected, unknown algorithm) with manipulated RRSIG.Labels. When a victim's Unbound resolver performs RFC 8198 aggressive NSEC processing covering the parent's NSEC chain, it prematurely caches these as valid, bringing non-existent sibling delegations into insecure existence and letting the attacker serve spoofed insecure DNS records for unrelated domains under the same parent. No public exploit is identified at time of analysis, and the network attack vector requires no authentication to the resolver.