# CVE-2026-77955: NLnet Labs Unbound ZONEMD check bypass in delegated zones

Source: https://junglewise.ai/threats/cve-2026-77955-nlnet-labs-unbound-zonemd-check-bypass-in-delegated-zones  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-77955 · Severity: medium · CVSS 4.4 · Published 2026-09-16

Unbound is a DNS resolver used to translate domain names into IP addresses. A vulnerability in the ZONEMD integrity checking feature allows an attacker to serve tampered DNS records before validation completes, or cause tampered data to persist on disk. This could lead to DNS cache poisoning or serving malicious content without detection.

Technologies: [NLnet Labs Unbound](https://junglewise.ai/threats/technologies/unbound). Vendors: [NLnet Labs](https://junglewise.ai/threats/vendors/nlnet-labs).

## Quick answers

**Is CVE-2026-77955 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77955 being exploited in the wild.

**How severe is CVE-2026-77955?** Medium severity, with a CVSS score of 4.4, published 16 September 2026.

**Which products and versions are affected?** NLnet Labs Unbound 1.13.2 through 1.26.0.

**Is there a fix for CVE-2026-77955?** A patch was published on 2026-09-16: Unbound 1.26.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77955 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77955?** Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a time-of-check-time-of-use (TOCTOU) flaw in ZONEMD integrity validation for delegated zones below (but not at) a trust anchor. Because DS/DNSKEY records must be asynchronously resolved before ZONEMD verification completes, an attack window exists where tampered zone contents are served in memory or written to disk before the integrity check concludes. If a zonefile is persisted to disk during a failed check, the corrupted data reloads on service restart and remains available until ZONEMD validation completes again. The vulnerability affects Unbound versions 1.13.2 through 1.26.0 and requires ZONEMD checking to be enabled (zonemd-check: yes). A fix in Unbound 1.26.1 ensures zones are only made available after ZONEMD validation succeeds.

## Affected products

- NLnet Labs Unbound 1.13.2 through 1.26.0

## Timeline

- 2026-09-16: disclosed
- 2026-09-16: patched: Unbound 1.26.1 released with fix

## References

- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt)

## Related threats

- [NLnet Labs Unbound use-after-free in DNS-over-QUIC stream cleanup](https://junglewise.ai/threats/cve-2026-97206-nlnet-labs-unbound-1-22-0-up-to-and-including-version-1-26-1)
- [NLnet Labs Unbound DNS decompression CPU exhaustion](https://junglewise.ai/threats/cve-2026-96405-nlnet-labs-unbound-up-to-and-including-version-1-26-1-limits)
- [NLnet Labs Unbound DNS validator bypass in DNSSEC validation](https://junglewise.ai/threats/cve-2026-50106-when-nlnet-labs-unbound-up-to-and-including-version-1-26-1-is)
- [NLnet Labs Unbound cache side-channel in upstream source port probe](https://junglewise.ai/threats/cve-2026-109125-in-nlnet-labs-unbound-up-to-and-including-version-1-26-1-an)
- [NLnet Labs Unbound DNS complexity attacks via ReTrap](https://junglewise.ai/threats/cve-2026-85501-nlnet-labs-unbound-dns-complexity-attacks-via-retrap)