CVE-2026-50106: CWE-807: Reliance on Untrusted Inputs in a Security Decision in NLnet Labs Unbound

This vulnerability (CWE-807) occurs in NLnet Labs Unbound versions up to and including 1.26.1 when configured with a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain. An attacker capable of delivering a single forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, can trick Unbound's validator into using the root trust anchor and the insecure parent consecutively. This causes the validator to treat the record as insecure and deny existence for records in the trust island, effectively causing a denial of service for those DNS records.

The vulnerability allows an attacker to cause Unbound to incorrectly treat DNS records within a configured island-of-security zone as insecure, resulting in denial of existence responses for those records. This can disrupt DNS resolution for affected zones, leading to denial of service. The CVSS 3.1 score is 6.5 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

No official patch or fix is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should carefully review their Unbound configuration regarding root trust anchors and additional trust-anchor settings for island-of-security zones, and consider disabling or modifying such configurations to avoid exposure to this issue.