CVE-2026-77955

The record

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.

Affected packages

Related vulnerabilities

• CVE-2026-19941 An inapplicable NSEC record may be accepted by a `named` resolver as proof that no… CWE-345
• CVE-2026-14663 Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover… CWE-345
• CVE-2026-73419 NextAuth.js provides authentication for Next.js. CWE-345
• CVE-2026-68945 Angular is a development platform for building mobile and desktop web applications using… CWE-345
• CVE-2026-50248 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a… CWE-345
• CVE-2026-44690 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the… CWE-345
• CVE-2026-48816 sigstore-js provides JavaScript libraries for interacting with Sigstore services. CWE-345
• CVE-2026-47737 Puma is a Ruby/Rack web server built for parallelism. CWE-345