Executive brief
NLnet Labs Unbound, a widely used DNS resolver, contains a flaw that can cause it to incorrectly ignore certain configured network zones. This occurs when a specific security setting (enabled by default) mistakenly treats a valid internal or private zone as non-existent based on information from the public internet. In practice, this can lead to service disruptions where internal applications or services become unreachable because the DNS resolver fails to route traffic to the correct destination.
Technical details
An off-by-one error exists in Unbound's 'harden-below-nxdomain' logic, which is enabled by default. The vulnerability occurs during an upward DNS cache walk where a delegation point guard fails to correctly protect the stub/forward zone apex. Specifically, the guard tests the domain name before stripping a label, allowing an iteration where the apex passes the guard but then probes the cache of the immediate public parent. If the parent contains a cached DNSSEC-secure NXDOMAIN for an intermediate label, Unbound will synthesize an NXDOMAIN response for the configured zone, effectively bypassing the stub/forward configuration. This issue affects versions 1.13.2 through 1.25.1 and is fixed in version 1.25.2.
Affected products
- NLnet Labs Unbound 1.13.2 up to and including 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in Unbound 1.25.2