EUVD-2026-80287
GHSA-w62x-5q5r-fgmp
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
On-path tamper of a zone transfer plus a transient async race is AC:H/PR:N (no resolver auth); integrity impact is transient and self-correcting so I:L, with no C or A impact.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
4DescriptionCVE.org
In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.
AnalysisAI
Unbound 1.13.2 through 1.26.1 can serve tampered contents of a ZONEMD-checked zone that sits below - but not at - a DNSSEC trust anchor, because the DS/DNSKEY chain resolution needed to validate the zone must complete asynchronously and the zone data is released (and, with the zonefile: option, written to disk) before the ZONEMD digest check concludes. In memory the exposure is self-correcting: once verification fails the data stops being served, but a tampered copy written to disk persists and is reloaded at the next startup until verification again concludes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a locally-served zone with ZONEMD verification enabled (zonemd-check: yes) that is located below - but not at - a configured trust anchor, so that asynchronous DS/DNSKEY resolution must complete before the ZONEMD check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-to-moderate integrity/authenticity issue (CVSS 4.4, CWE-345), not a high-priority remotely-weaponizable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed Unbound release from NLnet Labs and verify the exact patched version and upgrade instructions in the vendor advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt; no specific fix version is listed in the available intelligence, so the advisory is the authoritative source for patch status. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC
Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker wh
Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone
Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-fr
A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
Share
External POC / Exploit Code
Leaving vuln.today