CVE-2026-50106Medium· 6.5▾ SunlitWhen NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.
Unbound < 1.26.2This issue is fixed starting with version 1.26.2
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96405Medium· 5.3Aggregate DNS name chained pointer decompression work leads to degradation of service.
CVE-2026-109125Medium· 5.3Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'
CVE-2026-35501Low· 3.7Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.
CVE-2026-97206High· 7.5DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
CVE-2019-16866High· 7.5Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query
CVE-2026-32665High· 7.5Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass