CVE-2026-50106: falha de média gravidade em NLnet Labs Unbound
Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.2%
When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Produtos afetados
NLnet Labs · UnboundCVEs relacionadas — NLnet Labs Unbound
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1931HIGHDenial of service when trimming EDE text on positive repliesEPSS 2.5%CVE-2022-3204HIGHNRDelegation AttackEPSS 1.6%CVE-2026-33278CRITICALPossible arbitrary code execution during DNSSEC validationEPSS 1.4%CVE-2022-30699—Novel "ghost domain names" attack by updating almost expired delegation informationEPSS 1.2%CVE-2022-30698—Novel "ghost domain names" attack by introducing subdomain delegationsEPSS 1.2%CVE-2026-81642CRITICALHeap buffer overflow and possible Remote Code Execution when digesting DNSKEYEPSS 1.0%