In NLnet Labs Unbound versions 1.13.2 up to and including 1.26.1, a vulnerability exists in zones configured with ZONEMD (zonemd-check: yes) that are below but not at a trust anchor. The asynchronous resolution of DS/DNSKEY records before ZONEMD verification allows an attack window where tampered zone data can be served or stored on disk prior to integrity verification. If the zonefile option is enabled and tampered data is written to disk while the ZONEMD check fails, this corrupted data is reloaded on Unbound startup and remains available until the ZONEMD check completes again. If verification ultimately fails, the data is no longer served but remains on disk for future reloads.

This vulnerability allows tampered zone data to be temporarily served or stored on disk before ZONEMD integrity verification completes, potentially exposing clients to manipulated DNS data. Persisted tampered data on disk may be reloaded on service restart, extending the window of exposure until verification succeeds. The CVSS score of 4.4 (medium severity) reflects the limited attack vector (network, high complexity, requires privileges) and impact (integrity compromised, no confidentiality or availability impact).

No official patch or fix is indicated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling ZONEMD checks on zones below trust anchors or avoid enabling the zonefile option to prevent tampered data persistence. Monitor vendor communications for updates and patches addressing this issue.