CVE-2026-44687

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.13.2 through 1.25.1

Description An off-by-one error exists in the harden-below-nxdomain logic, which is enabled by default. This issue occurs when stub or forward zones are located below an intermediate label that is itself below a DNSSEC signed zone. The harden-below-nxdomain feature performs an upward DNS cache walk with a delegation point guard intended to prevent NXDOMAIN synthesis above stub or forward zones. However, because the guard tests the domain name before stripping a label, it allows an iteration where the domain name matches the configured stub or forward zone apex. The process then strips one more label and probes the cache of the apex's immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, the walk returns it, causing the configured stub or forward upstream to be bypassed and never contacted. This behavior is triggered by a query for the intermediate label between the stub or forward apex and the DNSSEC parent zone.

Recommendations Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, consider disabling the harden-below-nxdomain logic.