CVE-2026-44690: NLnet Labs Unbound cache poisoning via aggressive NSEC processing

CVE-2026-44690 · Severity: high · CVSS 7.5 · Published 2026-07-22

Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A security flaw allows an attacker who owns a single domain to trick the resolver into storing false information about other, unrelated domains. This could allow attackers to redirect users to malicious websites or intercept traffic for domains they do not own.

Technologies: NLnet Labs Unbound. Vendors: NLnet Labs.

Quick answers

Is CVE-2026-44690 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44690 being exploited in the wild.
How severe is CVE-2026-44690?
High severity, with a CVSS score of 7.5, published 22 July 2026.
Which products and versions are affected?
NLnet Labs Unbound 1.7.0 up to and including 1.25.1.
Is there a fix for CVE-2026-44690?
A patch was published on 2026-07-22: Fixed in version 1.25.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44690 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44690?
Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cache poisoning vulnerability exists in Unbound's implementation of RFC 8198 (aggressive NSEC processing). The flaw stems from insufficient validation of the RRSIG.Labels field and premature cache writes before full validation is complete. An attacker controlling a delegated zone under an NSEC-signed parent (like a TLD) can provide fraudulent wildcard DS records with fewer labels than expected. This allows the attacker to bring non-existent delegations into 'insecure' existence and inject malicious records for sibling domains within the same parent zone. The issue is fixed in Unbound 1.25.2 by adding lower-bound checks on RRSIG labels and ensuring cache writes occur only after validation.

Affected products

  • NLnet Labs Unbound 1.7.0 up to and including 1.25.1

Timeline

  • 2026-07-22: disclosed
  • 2026-07-22: advisory
  • 2026-07-22: patched: Fixed in version 1.25.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.