CVE-2026-77955 describes an insufficient verification of data authenticity vulnerability (CWE-345) in NLnet Labs Unbound DNS resolver versions >=1.13.2 and <1.26.1. When ZONEMD is enabled with zonemd-check: yes on zones below a trust anchor, asynchronous DS/DNSKEY resolution delays the ZONEMD integrity check. During this delay, tampered zone contents can be served or written to disk. If the zonefile is persisted while the ZONEMD check fails, the tampered data remain on disk and are reloaded on restart until verification passes. Although the data is not served after verification failure, the persistence on disk creates a risk window of serving unauthenticated data.

The vulnerability allows a window of time during which tampered zone data may be served or stored on disk before ZONEMD verification completes. This can lead to serving unauthenticated, potentially malicious DNS data temporarily. However, once verification fails, the data is no longer served, limiting the impact. There is no indication of confidentiality or availability impact. The CVSS score of 4.4 (medium) reflects this limited integrity impact with high attack complexity and required privileges.

No official patch or fix is currently indicated in the provided data. Users should monitor vendor advisories for updates. Until a fix is available, consider disabling ZONEMD checks on affected versions or avoid writing zonefiles to disk when ZONEMD is enabled to reduce the risk window. Patch status is not yet confirmed — check the NLnet Labs advisory for current remediation guidance.