CVE-2026-77955: NLnet Labs Unbound Information Disclosure

CVE-2026-77955 Overview

CVE-2026-77955 affects NLnet Labs Unbound versions 1.13.2 through 1.26.1. The vulnerability exists in ZONEMD-configured zones (zonemd-check: yes) that reside below, but not at, a trust anchor. Unbound serves or writes zone contents to disk before completing the ZONEMD integrity check, creating a window where tampered data reaches clients. The delay results from the required asynchronous DS/DNSKEY resolution that must occur before ZONEMD verification finishes. If the zonefile: option persists the zone to disk during a failed check, the tampered data reloads on the next startup and remains available until verification concludes again. This weakness maps to insufficient verification of data authenticity [CWE-345].

Critical Impact
Attackers with the ability to tamper with zone contents can have manipulated DNS records served by Unbound resolvers during the ZONEMD verification window, and persisted to disk for future reloads.

Affected Products

NLnet Labs Unbound 1.13.2 through 1.26.1
Deployments using ZONEMD verification (zonemd-check: yes) on zones below a trust anchor
Deployments using the zonefile: option to persist zone data to disk

Discovery Timeline

2026-09-16 - CVE-2026-77955 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77955

Vulnerability Analysis

ZONEMD (RFC 8976) provides cryptographic integrity verification for DNS zone data by embedding a message digest in the zone itself. Unbound supports ZONEMD verification through the zonemd-check: yes directive. For zones located below a trust anchor rather than at one, Unbound must asynchronously resolve DS and DNSKEY records to establish the chain of trust before validating the digest.

During this asynchronous resolution window, Unbound treats the loaded zone contents as usable. Queries against the zone receive answers derived from unverified data. If an attacker has tampered with the zone contents prior to load, clients receive manipulated responses until ZONEMD verification completes and rejects the zone.

The persistence dimension amplifies the exposure. When the zonefile: option writes zone data to disk while the ZONEMD check has failed, the tampered content survives restart. Unbound reloads the corrupted zone on startup and again serves it during the verification window. Even after verification fails, the on-disk copy persists for future reload cycles.

Root Cause

The root cause is a time-of-check versus time-of-use ordering flaw. Unbound makes zone data available for query resolution and disk persistence before the asynchronous DS/DNSKEY resolution required for ZONEMD validation completes. Integrity verification is not enforced as a precondition for data availability.

Attack Vector

Exploitation requires an attacker capable of tampering with zone contents delivered to the resolver, along with high privileges as reflected in the attack complexity. The network attack vector applies because manipulated zone data reaches DNS clients during the verification window. The impact is limited to integrity of DNS responses; confidentiality and availability are not directly affected.

The vulnerability manifests in Unbound's zone loading and ZONEMD verification sequencing. See the NLnet Labs CVE-2026-77955 advisory for authoritative technical details.

Detection Methods for CVE-2026-77955

Indicators of Compromise

Unbound log entries indicating ZONEMD verification failure after zone data has already been served to clients
Persistent zone files on disk that fail ZONEMD verification on reload
DNS responses containing records that do not match the authoritative zone publisher's expected data

Detection Strategies

Audit Unbound configurations for zones using zonemd-check: yes combined with the zonefile: persistence option below a trust anchor
Correlate Unbound query logs with ZONEMD verification outcomes to identify answers served during pending verification windows
Compare on-disk zone files against authoritative zone publishers' signed data to detect tampered persistence

Monitoring Recommendations

Enable verbose Unbound logging for ZONEMD verification events and forward to a central log platform
Alert on ZONEMD verification failures followed by continued query responses for the same zone
Monitor file integrity on directories containing Unbound zone files persisted via the zonefile: option

How to Mitigate CVE-2026-77955

Immediate Actions Required

Inventory Unbound deployments and identify instances running versions 1.13.2 through 1.26.1
Review configurations for ZONEMD-verified zones below a trust anchor that also use the zonefile: persistence option
Upgrade to a fixed Unbound release once available from NLnet Labs, per the vendor advisory
Purge any persisted zone files that may contain tampered content prior to restart

Patch Information

Refer to the NLnet Labs advisory for CVE-2026-77955 for the fixed version and upgrade instructions. Apply the vendor-supplied patch on all resolver instances running affected versions.

Workarounds

Disable the zonefile: persistence option for zones using ZONEMD verification below a trust anchor to prevent tampered data from surviving restart
Place ZONEMD-verified zones at a trust anchor where feasible to avoid the asynchronous DS/DNSKEY resolution window
Restrict network paths that could allow an attacker to substitute tampered zone contents during transfer

bash

# Configuration example: remove zonefile persistence for ZONEMD-checked zones
# /etc/unbound/unbound.conf
auth-zone:
    name: "example.com"
    zonemd-check: yes
    # zonefile: "/var/lib/unbound/example.com.zone"  # disable persistence
    for-downstream: yes
    for-upstream: yes