CVE-2026-35501

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.0.1 through 1.26.1

Description A flaw exists when the software is configured with both a root trust anchor and an additional trust-anchor: for an island-of-security zone whose parent is provably insecure under the root chain. A malicious actor can use a forged NSEC reply with the SOA bit cleared to trick the system into treating the configured trust island as insecure. This occurs because the DNSSEC validator accepts and caches the NSEC insecure response, bypassing the required RRSIG validation. This behavior stems from a previous fix regarding type DS and NSEC queries from clients when a trust anchor for that name existed.

Recommendations Update NLnet Labs Unbound to a version later than 1.26.1.