CVE-2026-35501: CWE-354: Improper Validation of Integrity Check Value in NLnet Labs Unbound

This vulnerability involves improper validation of integrity check values (CWE-354) in NLnet Labs Unbound DNSSEC validator. When configured with a root trust anchor and an additional trust-anchor for an island-of-security zone with an insecure parent, Unbound versions 1.0.1 up to and including 1.26.1 can be tricked by a forged NSEC reply with the SOA bit cleared. The validator accepts and caches the insecure NSEC response, bypassing the required RRSIG validation. This acceptance is due to an old fix related to DS and NSEC queries from clients when a trust anchor for that name existed.

The vulnerability allows a malicious actor to cause Unbound to treat a configured trust island as insecure by accepting a forged NSEC insecure response. This may lead to incorrect DNSSEC validation results, potentially undermining the security guarantees of DNSSEC validation. The CVSS score is 3.7 (low severity), indicating limited impact with no confidentiality or availability impact, and only low integrity impact.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should carefully review their Unbound configuration regarding trust anchors and consider avoiding configurations that combine a root trust anchor with additional trust-anchors for islands-of-security with insecure parents.