Executive brief
Unbound is a DNS resolver used to translate domain names into IP addresses. A vulnerability in the ZONEMD integrity checking feature allows an attacker to serve tampered DNS records before validation completes, or cause tampered data to persist on disk. This could lead to DNS cache poisoning or serving malicious content without detection.
Technical details
The vulnerability is a time-of-check-time-of-use (TOCTOU) flaw in ZONEMD integrity validation for delegated zones below (but not at) a trust anchor. Because DS/DNSKEY records must be asynchronously resolved before ZONEMD verification completes, an attack window exists where tampered zone contents are served in memory or written to disk before the integrity check concludes. If a zonefile is persisted to disk during a failed check, the corrupted data reloads on service restart and remains available until ZONEMD validation completes again. The vulnerability affects Unbound versions 1.13.2 through 1.26.0 and requires ZONEMD checking to be enabled (zonemd-check: yes). A fix in Unbound 1.26.1 ensures zones are only made available after ZONEMD validation succeeds.
Affected products
- NLnet Labs Unbound 1.13.2 through 1.26.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Unbound 1.26.1 released with fix