Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-77955

Possible ZONEMD verification bypass window

CVSS 3.1 4.4 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-77955

Published

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-77955

Published

Unbound

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "NLnet Labs",
                    "product": "Unbound",
                    "versions": [
                        {
                            "version": "1.13.2",
                            "status": "affected",
                            "lessThan": "1.26.1",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON