In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed… (CVE-2026-44687)

CVE-2026-44687 affects NLnet Labs Unbound DNS resolver versions 1.13.2 up to and including 1.25.1. The vulnerability is caused by an off-by-one error in the 'harden-below-nxdomain' feature, which is enabled by default. This feature performs an upward DNS cache walk with a delegation point guard to prevent NXDOMAIN synthesis above stub or forward zones. However, the guard incorrectly tests the domain name before stripping a label, leading to a scenario where a DNSSEC-secure NXDOMAIN cached at the immediate public parent of the stub/forward zone apex causes the resolver to return NXDOMAIN prematurely. As a result, the configured stub or forward zone is never queried, causing queries for intermediate labels below a DNSSEC signed zone to be shadowed by the parent's NXDOMAIN response. This can disrupt DNS resolution for affected zones but does not compromise data confidentiality or integrity.

The vulnerability can cause denial of service for DNS queries targeting stub or forward zones below an intermediate label under a DNSSEC signed zone. The resolver returns a DNSSEC-secure NXDOMAIN response from the parent zone instead of querying the configured stub or forward zone, preventing resolution of the intended domain. There is no impact on confidentiality or integrity, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider disabling the 'harden-below-nxdomain' feature if feasible or carefully review DNS configurations to avoid reliance on stub or forward zones below intermediate labels under DNSSEC signed zones. Monitor vendor communications for official fixes or updates.