CVE-2026-44687: NLnet Labs Unbound Auth Bypass Flaw

CVE-2026-44687 Overview

CVE-2026-44687 is an off-by-one flaw [CWE-193] in NLnet Labs Unbound versions 1.13.2 through 1.25.1. The bug lives in the harden-below-nxdomain logic, which is enabled by default. Under specific conditions, Unbound returns a cached DNSSEC-secure NXDOMAIN from a public parent zone instead of contacting a configured stub or forward zone. Operators relying on stub or forward configurations for private namespaces nested two or more labels below a DNSSEC-signed public zone can experience resolution failures. The issue affects availability of internal name resolution but does not expose data or allow code execution.

Critical Impact
A configured stub or forward zone is silently bypassed, and queries for the intermediate label return NXDOMAIN, breaking resolution of private namespaces nested under DNSSEC-signed public zones.

Affected Products

NLnet Labs Unbound 1.13.2 through 1.25.1
Deployments using harden-below-nxdomain (default enabled)
Configurations with stub or forward zones nested two or more labels below a DNSSEC-signed public zone

Discovery Timeline

2026-07-22 - CVE-2026-44687 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-44687

Vulnerability Analysis

Unbound's harden-below-nxdomain feature performs an upward DNS cache walk to synthesize NXDOMAIN responses when a parent domain is known to not exist. A delegation point guard is intended to stop the walk before it crosses into a configured stub or forward zone apex. The guard evaluates the current domain name before stripping the next label. This ordering error allows the iteration to reach the stub or forward apex, pass the guard, strip one additional label, and then probe the cache at the apex's immediate public parent.

If that parent has a cached DNSSEC-secure NXDOMAIN, Unbound returns that NXDOMAIN to the client. The configured stub or forward upstream is never contacted. Only queries for the intermediate label between the stub/forward apex and the DNSSEC parent zone trigger the flaw. Impact is limited to availability of internal resolution.

Root Cause

The root cause is an off-by-one error [CWE-193] in the delegation point guard inside harden-below-nxdomain. The guard checks the domain name one iteration too early relative to the label-stripping step, permitting a lookup at the parent of the configured apex.

Attack Vector

Exploitation is network-based but requires specific preconditions: an attacker or normal query must target the intermediate label between the stub/forward apex and its DNSSEC-signed public ancestor, and the public ancestor must already hold a cached DNSSEC-secure NXDOMAIN covering that name. The result is a denial of resolution for private zones. Refer to the NLnet Labs advisory for exact reproduction conditions.

Detection Methods for CVE-2026-44687

Indicators of Compromise

Client resolution failures for names inside stub or forward zones that are nested two or more labels below a DNSSEC-signed public zone.
Unbound returning NXDOMAIN with the AD bit set for names that should resolve via a configured stub or forward upstream.
Absence of upstream queries to the configured stub or forward server for the affected intermediate label.

Detection Strategies

Inventory Unbound instances and compare running versions against the vulnerable range 1.13.2 to 1.25.1 using unbound-control status.
Enable Unbound query logging and correlate NXDOMAIN responses for private namespaces against expected upstream traffic to the configured stub or forward server.
Perform targeted dig tests against each intermediate label between a stub/forward apex and its DNSSEC-signed public parent to reproduce unexpected NXDOMAIN responses.

Monitoring Recommendations

Alert on sustained increases in NXDOMAIN answers for internal domains that historically resolved successfully.
Monitor packet flows between Unbound resolvers and configured stub or forward upstreams for missing query traffic.
Track Unbound package versions across the fleet through configuration management to detect systems still on vulnerable releases.

How to Mitigate CVE-2026-44687

Immediate Actions Required

Identify all Unbound resolvers running versions 1.13.2 through 1.25.1 and schedule upgrades to a fixed release.
Review configurations for stub or forward zones nested under DNSSEC-signed public parents and validate resolution end-to-end.
Where patching is not immediate, apply the workaround below to disable the affected hardening logic.

Patch Information

NLnet Labs has published details of the fix in the official Unbound advisory. Upgrade Unbound to the fixed version listed in the advisory to restore correct delegation point guard behavior in harden-below-nxdomain.

Workarounds

Set harden-below-nxdomain: no in unbound.conf to disable the vulnerable code path until the upgrade is applied.
Restructure affected private namespaces so the stub or forward apex is not nested below a DNSSEC-signed public zone by more than one label.
Pre-populate local-zone or local-data entries for the intermediate label to override cached NXDOMAIN responses.

bash

# Configuration example: disable harden-below-nxdomain in unbound.conf
server:
    harden-below-nxdomain: no

# Apply the change
unbound-checkconf /etc/unbound/unbound.conf
systemctl restart unbound