CVE-2026-44690 is a vulnerability in NLnet Labs Unbound DNS resolver versions 1.7.0 up to and including 1.25.1. It arises from insufficient verification of the RRSIG.Labels field and premature cache writes during aggressive NSEC processing as defined in RFC 8198. This flaw permits a malicious actor who controls a single delegated zone under an NSEC-signed parent domain to poison the DNS cache for arbitrary sibling zones under the same parent. The attacker can create fraudulent wildcard DS records with fewer labels than expected or unknown algorithms, causing arbitrary delegations covered by the parent's NSEC chain to be treated as insecurely existing. This leads to injection of insecure wildcard DNS records for those delegations, enabling cache poisoning attacks that undermine DNS integrity for sibling domains.

The vulnerability allows an unauthenticated attacker controlling a single domain under an NSEC-signed top-level domain to perform cache poisoning attacks on unrelated sibling domains sharing the same parent zone. This can result in injection of insecure wildcard DNS records, potentially redirecting or disrupting DNS resolution for those sibling domains. The CVSS 3.1 score is 7.5 (High), reflecting the network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to integrity without confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented as of the published date. Users of affected Unbound versions should monitor NLnet Labs advisories for updates and consider restricting aggressive NSEC processing if feasible as a temporary mitigation until a patch is available.