The CVE number for this vulnerability is CVE-2026-50106.


== Description
When Unbound is configured with both a root trust anchor and an additional
'trust-anchor:' for an island-of-security zone whose parent is provably
insecure under the root chain, a malicious actor who can deliver one forged
NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG
'SignerName' set to the insecure parent, tricks Unbound's validator to use the
root trust anchor instead, and consecutively the insecure parent, thus causing
that record to be treated as insecure and denying existence for records in the
trust island.

Unbound 1.26.2 includes a fix that insists that a denial is from a signed
parent, and it must be secure.


== Affected products
Unbound up to and including version 1.26.1.


== Mitigation

=== Downloading patched version
Unbound 1.26.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.2.tar.gz

=== Applying the patch manually
For Unbound 1.26.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-50106_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-50106_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-50106.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.26.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.