# CVE-2026-44690: NLnet Labs Unbound cache poisoning via aggressive NSEC processing

Source: https://junglewise.ai/threats/cve-2026-44690-nlnet-labs-unbound-cache-poisoning-via-aggressive-nsec-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-44690 · Severity: high · CVSS 7.5 · Published 2026-07-22

Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A security flaw allows an attacker who owns a single domain to trick the resolver into storing false information about other, unrelated domains. This could allow attackers to redirect users to malicious websites or intercept traffic for domains they do not own.

Technologies: [NLnet Labs Unbound](https://junglewise.ai/threats/technologies/unbound). Vendors: [NLnet Labs](https://junglewise.ai/threats/vendors/nlnet-labs).

## Quick answers

**Is CVE-2026-44690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44690 being exploited in the wild.

**How severe is CVE-2026-44690?** High severity, with a CVSS score of 7.5, published 22 July 2026.

**Which products and versions are affected?** NLnet Labs Unbound 1.7.0 up to and including 1.25.1.

**Is there a fix for CVE-2026-44690?** A patch was published on 2026-07-22: Fixed in version 1.25.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44690 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44690?** Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cache poisoning vulnerability exists in Unbound's implementation of RFC 8198 (aggressive NSEC processing). The flaw stems from insufficient validation of the RRSIG.Labels field and premature cache writes before full validation is complete. An attacker controlling a delegated zone under an NSEC-signed parent (like a TLD) can provide fraudulent wildcard DS records with fewer labels than expected. This allows the attacker to bring non-existent delegations into 'insecure' existence and inject malicious records for sibling domains within the same parent zone. The issue is fixed in Unbound 1.25.2 by adding lower-bound checks on RRSIG labels and ensuring cache writes occur only after validation.

## Affected products

- NLnet Labs Unbound 1.7.0 up to and including 1.25.1

## Timeline

- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in version 1.25.2

## References

- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44690.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44690.txt)

## Related threats

- [NLnet Labs Unbound use-after-free in DNS-over-QUIC stream cleanup](https://junglewise.ai/threats/cve-2026-97206-nlnet-labs-unbound-1-22-0-up-to-and-including-version-1-26-1)
- [NLnet Labs Unbound DNS decompression CPU exhaustion](https://junglewise.ai/threats/cve-2026-96405-nlnet-labs-unbound-up-to-and-including-version-1-26-1-limits)
- [NLnet Labs Unbound DNS validator bypass in DNSSEC validation](https://junglewise.ai/threats/cve-2026-50106-when-nlnet-labs-unbound-up-to-and-including-version-1-26-1-is)
- [NLnet Labs Unbound cache side-channel in upstream source port probe](https://junglewise.ai/threats/cve-2026-109125-in-nlnet-labs-unbound-up-to-and-including-version-1-26-1-an)
- [NLnet Labs Unbound DNS complexity attacks via ReTrap](https://junglewise.ai/threats/cve-2026-85501-nlnet-labs-unbound-dns-complexity-attacks-via-retrap)