CVE-2026-77955: Possible ZONEMD verification bypass window
In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NLnet Labs Unboundto a version that resolves this vulnerability.Fixed in 1.26.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments use NLnet Labs Unbound versions 1.13.2 through 1.26.1 and have ZONEMD configured zones with zonemd-check set to yes. The affected zone must be below, but not itself at, a trust anchor.
What conditions are needed for tampered zone data to remain available after a restart?
The zone must be configured to write a zonefile to disk. If that file is written while ZONEMD verification later fails, the tampered data can be reloaded at startup and remain available until ZONEMD verification finishes again.
Does failed ZONEMD verification immediately remove the tampered data?
No. Tampered contents can be served or stored before the ZONEMD integrity check completes because DS/DNSKEY resolution is asynchronous. Once verification fails, the data is no longer served, but it remains on disk if it was written there.