CVE-2026-77955: nlnet labs unbound
Vulnerability summary
CVE-2026-77955 is a medium (CVSS 4.4) vulnerability in nlnet labs unbound. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 8 · Related 6Timeline
- 16-09-2026PublishedVulnerability first disclosed.
- 16-09-2026Last modifiedVulnerability information updated.
Description
In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
- NVDNIST4.4MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
+0.04 pp
From 0.13% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- unboundAll versions (No fix recorded) | < 1.26.1-0+deb13u1 | < 1.26.1-1
Nlnet labs1 product
- unbound≥ 1.13.2, < 1.26.1
Nlnetlabs1 product
- unbound≥ 1.13.2, < 1.26.1
Ubuntu1 product
- unboundAll versions (No fix recorded)
4 vendors · 4 products
