CVE-2026-44690 NLnet Labs CVE debrief

Who should care

Organizations using Unbound 1.7.0 to 1.25.1 for DNS resolution should assess and mitigate this vulnerability to prevent cache poisoning attacks. This includes reviewing and updating Unbound to a version that addresses this vulnerability, implementing additional monitoring and validation of DNS responses, and restricting DNS resolution to trusted sources. Security teams and vulnerability management teams should prioritize this vulnerability due to its potential impact on DNS resolution security.

Technical summary

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). This allows the malicious actor to inject insecure wildcard records for those delegations. The vulnerability has a high CVSS score of 7.5 and is classified as HIGH severity.

Defensive priority

High priority due to potential for cache poisoning and impact on DNS resolution security.

Recommended defensive actions

• Review and update Unbound to a version that addresses this vulnerability.
• Implement additional monitoring and validation of DNS responses to detect potential cache poisoning attempts.
• Restrict DNS resolution to trusted sources and limit the scope of DNS resolution to necessary zones.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but further analysis is needed to fully understand the impact and mitigation strategies. Affected product deployments should be identified and assessed for potential exposure. The RRSIG.Labels field validation issue in Unbound 1.7.0 to 1.25.1 allows for cache poisoning attacks. Organizations should verify their Unbound versions and plan for updates or mitigations. Evidence limits suggest that additional information may be required to fully understand the vulnerability's impact.

Official resources