---
id: CVE-2026-77955
title: >-
  In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in
  ZONEMD configured zones (zonemd-check: yes) which are located below (but not
  at) a trust anchor allow for an attack window where (tampered with) zone
  contents ar…
summary: >-
  In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in
  ZONEMD configured zones (zonemd-check: yes) which are located below (but not
  at) a trust anchor allow for an attack window where (tampered with) zone
  contents ar…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-345
  - CWE-367
vendor: NLnet Labs
product: Unbound
affected:
  - Unbound >= 1.13.2 < 1.26.1
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:41:10.423'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77955'
references:
  - url: 'https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt'
    label: sep@nlnetlabs.nl
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77955.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-77955'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2535053'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-77955'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77955'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68590'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-16T14:33:18.720420Z'
ingestedAt: '2026-09-16T08:52:29.599Z'
epss: 0.00128
epssPercentile: 0.02842
patched:
  - hardened_images
---

## Overview

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77955.json)
- **RHSA-2026:68590** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68590)