Quick answers
- Is CVE-2026-77955 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77955 being exploited in the wild.
- How severe is CVE-2026-77955?
- Medium severity, with a CVSS score of 4.4, published 16 September 2026.
- Which products and versions are affected?
- NLnet Labs Unbound 1.13.2 through 1.26.0.
- Is there a fix for CVE-2026-77955?
- A patch was published on 2026-09-16: Unbound 1.26.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-77955 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-77955?
- Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a time-of-check-time-of-use (TOCTOU) flaw in ZONEMD integrity validation for delegated zones below (but not at) a trust anchor. Because DS/DNSKEY records must be asynchronously resolved before ZONEMD verification completes, an attack window exists where tampered zone contents are served in memory or written to disk before the integrity check concludes. If a zonefile is persisted to disk during a failed check, the corrupted data reloads on service restart and remains available until ZONEMD validation completes again. The vulnerability affects Unbound versions 1.13.2 through 1.26.0 and requires ZONEMD checking to be enabled (zonemd-check: yes). A fix in Unbound 1.26.1 ensures zones are only made available after ZONEMD validation succeeds.
Affected products
- NLnet Labs Unbound 1.13.2 through 1.26.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Unbound 1.26.1 released with fix