The CVE number for this vulnerability is CVE-2026-44687.


== Summary
Stub or forward zones where the name is below an intermediate labed below
a DNSSEC signed zone could be shadowed by the intermediate label's secure
NXDOMAIN answer from the parent.
This is caused by an off-by-one error in 'harden-below-nxdomain' logic; enabled
by default.
It effectively bypasses the configuration and the configured stub/forward
zone is never contacted.

Unbound 1.25.2 includes the off-by-one fix.


== Affected products
Unbound 1.13.2 up to and including version 1.25.1.


== Description
'harden-below-nxdomain' does an upward DNS cache walk together with a delegation
point guard that does not allow NXDOMAIN synthesis above stub/forward zones.

The guard tests the domain name but before stripping a label.
This results in an iteration where the domain name equals the configured
stub/forward zone apex that passes the guard, strips one more label, and probes
the cache at the apex's immediate public parent.
If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any
private namespace nested two or more labels under a signed public name, the
walk returns it and the configured stub/forward upstream is never contacted.

This can only be triggered by the query for the intermediate label (between the stub/forward apex and the DNSSEC parent zone).

Unbound 1.25.2 includes the off-by-one fix.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-44687.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-44687.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.