The CVE number for this vulnerability is CVE-2026-35501.


== Description

When Unbound is configured with both a root trust anchor and an additional
'trust-anchor:' for an island-of-security zone whose parent is provably
insecure under the root chain, a malicious actor with a forged NSEC reply with
the SOA bit cleared can trick Unbound to treat the configured trust island as
insecure.

This happens because the DNSSEC validator in Unbound accepts and caches the
NSEC insecure response bypassing the RRSIG validation that the validator was
supposed to do.

The acceptance of the NSEC record at the trust anchor apex was allowed due to
and old fix for type DS and NSEC queries from clients when trust anchor for
that name existed.

Unbound 1.26.2 removes the obsolete code path to disallow accepting the NSEC
record on the configured trust anchor apex.


== Affected products
Unbound 1.0.1 up to and including version 1.26.1.


== Mitigation

=== Downloading patched version
Unbound 1.26.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.2.tar.gz

=== Applying the patch manually
For Unbound 1.26.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-35501.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-35501.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.26.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.