CVE-2026-44687 NLnet Labs CVE debrief

Who should care

Organizations using Unbound 1.13.2-1.25.1 for DNS resolution should verify their configurations and consider updating to a fixed version. This includes reviewing the current Unbound version, assessing potential exposure, and planning for updates or mitigations as necessary. Security teams and operators should be aware of the vulnerability's impact on their DNS infrastructure.

Technical summary

A vulnerability in Unbound 1.13.2-1.25.1 allows an off-by-one error in 'harden-below-nxdomain' logic to bypass DNSSEC NXDOMAIN checks, potentially causing stub or forward zones to be shadowed by intermediate labels' secure NXDOMAIN answers. This occurs because the 'harden-below-nxdomain' feature performs an upward DNS cache walk with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label, resulting in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex's immediate public parent.

Defensive priority

Low

Recommended defensive actions

• Verify Unbound configurations for stub and forward zones.
• Consider updating to a fixed Unbound version.
• Monitor DNS resolution for unusual patterns.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by an off-by-one error in 'harden-below-nxdomain' logic. The 'harden-below-nxdomain' feature is enabled by default and performs an upward DNS cache walk with a delegation point guard. The guard tests the domain name but before stripping a label, resulting in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard. This results in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex's immediate public parent.

Official resources