CVE-2026-50106

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.2

Description An issue exists when the software is configured with both a root trust anchor and an additional trust-anchor: for an island-of-security zone whose parent is provably insecure under the root chain. A malicious actor can deliver a forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG SignerName set to the insecure parent. This tricks the validator into using the root trust anchor and subsequently the insecure parent, resulting in the record being treated as insecure and denying the existence of records within the trust island.

Recommendations Update NLnet Labs Unbound to version 1.26.2 or later.