CVE-2026-44690: NLnet Labs Unbound Cache Poisoning Flaw

CVE-2026-44690 Overview

CVE-2026-44690 is a DNS cache poisoning vulnerability in NLnet Labs Unbound, a widely deployed validating and caching DNS resolver. The flaw affects versions 1.7.0 through 1.25.1. The resolver performs insufficient validation of the RRSIG.Labels field and writes records to cache prematurely during RFC 8198 aggressive NSEC processing. An attacker who controls one delegated zone under an NSEC-signed parent can inject fraudulent wildcard DS records and force sibling zones under the same parent into insecure existence. This turns a single malicious domain registration into a springboard for poisoning arbitrary sibling delegations. The vulnerability is categorized under [CWE-345] Insufficient Verification of Data Authenticity.

Critical Impact
A malicious actor with one domain under an NSEC-signed TLD can serve forged insecure DNS responses for unrelated sibling domains sharing the same parent zone.

Affected Products

NLnet Labs Unbound 1.7.0 through 1.25.1
Resolver deployments performing DNSSEC validation with RFC 8198 aggressive NSEC use
Recursive DNS infrastructure serving clients from NSEC-signed parent zones

Discovery Timeline

2026-07-22 - CVE-2026-44690 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-44690

Vulnerability Analysis

Unbound implements RFC 8198 aggressive use of NSEC/NSEC3 records to synthesize negative answers from cached authenticated denial-of-existence data. During this processing path, the resolver fails to properly validate the RRSIG.Labels field against the owner name of the record it signs. The RRSIG.Labels value must equal the number of labels in the original owner name and is the mechanism DNSSEC uses to distinguish wildcard expansions from explicit records. When validation is skipped or truncated, an attacker-controlled zone can present an RRSIG that claims coverage over names it has no authority for. Combined with premature cache insertion, the poisoned records become authoritative for subsequent queries served by the resolver.

Root Cause

Two defects combine to produce the flaw. First, the resolver does not verify that RRSIG.Labels matches the label count of the covered owner name, permitting wildcard synthesis for names outside the signer's authority. Second, records generated during aggressive NSEC processing are committed to the cache before full chain-of-trust checks complete. Fraudulent wildcard DS records with fewer labels than expected or with an unknown algorithm are accepted and cached, breaking the delegation model.

Attack Vector

The attacker registers a domain under an NSEC-signed TLD or other parent zone. They configure their authoritative nameserver to return crafted NSEC and RRSIG records that appear to cover sibling names under the same parent. When a victim resolver queries any covered sibling name, Unbound applies aggressive NSEC synthesis, accepts the malformed RRSIG.Labels value, and inserts insecure wildcard delegations into its cache. Subsequent client queries for the poisoned names receive attacker-controlled responses marked as insecure rather than bogus. Exploitation requires only network access and normal DNS traffic patterns.

See the NLnet Labs CVE-2026-44690 Report for the detailed technical description.

Detection Methods for CVE-2026-44690

Indicators of Compromise

Cached DS records with Labels values lower than the owner name label count
DS records referencing unknown or reserved DNSSEC algorithm numbers appearing for sibling zones
Unexpected insecure delegations for domains that should inherit DNSSEC validation from an NSEC-signed parent
Client traffic being directed to nameservers outside the legitimate delegation for a given zone

Detection Strategies

Audit Unbound cache contents using unbound-control dump_cache and inspect DS and RRSIG records for label count mismatches.
Compare resolver answers against a known-good validating resolver or authoritative source for zones under NSEC-signed parents.
Enable Unbound val-log-level: 2 logging and monitor for anomalous validation paths involving aggressive NSEC synthesis.

Monitoring Recommendations

Forward Unbound query and validation logs to a centralized log platform and alert on repeated insecure responses for previously secure zones.
Track version inventory across the DNS estate and flag any resolver running Unbound 1.7.0 through 1.25.1.
Monitor egress DNS traffic for queries directed to nameservers that do not match published NS records for the queried zone.

How to Mitigate CVE-2026-44690

Immediate Actions Required

Upgrade Unbound to a fixed release published by NLnet Labs above 1.25.1.
Flush the resolver cache after upgrade using unbound-control flush_zone . to remove any poisoned entries.
Inventory all recursive resolvers and confirm each is running a patched version before returning them to production.

Patch Information

NLnet Labs has published the advisory and fixed builds. Consult the NLnet Labs CVE-2026-44690 Report for the specific fixed version and change log entries. Apply the upgrade to all validating resolvers, including hidden and secondary caches.

Workarounds

Disable aggressive NSEC use by setting aggressive-nsec: no in unbound.conf until the patched version is deployed.
Restrict recursive service to trusted client networks with access-control statements to reduce the exposure window.
Where feasible, front Unbound with a validating resolver on a patched code base until upgrades complete.

bash

# Configuration example - disable aggressive NSEC as a temporary mitigation
# /etc/unbound/unbound.conf
server:
    aggressive-nsec: no
    harden-dnssec-stripped: yes
    val-log-level: 2

# Apply the change
unbound-checkconf
systemctl reload unbound
unbound-control flush_zone .