NLnet Labs Unbound CVE-2026-77955

Requires a locally-served zone with ZONEMD verification enabled (zonemd-check: yes) that is located below - but not at - a configured trust anchor, so that asynchronous DS/DNSKEY resolution must complete before the ZONEMD check. The attacker must be able to tamper with that zone's contents (on-path over the zone-transfer/source or a compromised primary) and hit the transient race window before verification concludes. Persistence beyond runtime additionally requires the operator to have set the zonefile: option, which writes the tampered data to disk for reload on startup. Limiting factors: high timing precision (AC:H), a non-default and specific zone/trust-anchor topology, the self-correcting nature of the window (data withdrawn once verification fails), and no confidentiality or availability impact. Affects Unbound 1.13.2 through 1.26.1.

This is a low-to-moderate integrity/authenticity issue (CVSS 4.4, CWE-345), not a high-priority remotely-weaponizable flaw. The provided vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N already reflects meaningful barriers: high attack complexity and a privileged/on-path position. There is no EPSS score, no CISA KEV listing, and no public POC provided - consistent with a vendor-self-reported (NLnet Labs) advisory rather than observed exploitation, so exploitation status is 'no public exploit identified at time of analysis.' The realistic exposure is narrow: it only affects locally-served ZONEMD zones (zonemd-check: yes) positioned below - but not at - a trust anchor, and the window is transient because the async DS/DNSKEY resolution eventually completes and pulls failing data. The one lingering signal is on-disk persistence (zonefile: option), where tampered data survives reboots until re-verification, but tampered data is withdrawn from service once ZONEMD verification fails. Note a labeling conflict: the input Tags mark this 'Information Disclosure', but the vector (C:N, I:H) and CWE-345 make this an integrity/data-authenticity issue, not confidentiality - the tag is mislabeled. Also, the vendor's PR:H is questionable: the attacker's real requirement is an on-path/tamper position over the zone-transfer or zone source, which is better modeled as AC:H with PR:N than as a privilege on the resolver itself.

An on-path attacker (or a compromised/spoofed primary for a locally-served zone) tampers with the contents of a ZONEMD-protected zone configured below a trust anchor. During the brief window while Unbound is still performing asynchronous DS/DNSKEY resolution, the resolver serves the tampered records (and, if zonefile: is set, writes them to disk) before the ZONEMD integrity check completes and rejects them. No public POC is provided; exploitation requires precise timing against the async-verification race.