CVE-2026-44690 Cross-zone wildcard cache poisoning via RRSIG.labels manipulation
Attackers can poison DNS cache for sibling domains via RRSIG manipulation in Unbound, requiring aggressive NSEC processing enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44690?
CVE-2026-44690 is a high-severity vulnerability in Nlnetlabs Unbound, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.
Weakness: CWE-345
Which versions are affected by CVE-2026-44690?
It affects 1 product.
Linux distribution packages (13)
python3-unbound AlmaLinux:8 | All versions | 1.16.2-5.14.el8_10 |
unbound AlmaLinux:8 | All versions | 1.16.2-5.14.el8_10 |
unbound-devel AlmaLinux:8 | All versions | 1.16.2-5.14.el8_10 |
unbound-libs AlmaLinux:8 | All versions | 1.16.2-5.14.el8_10 |
python3-unbound Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.14.el8_10 |
python3-unbound-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.14.el8_10 |
unbound Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.14.el8_10 |
unbound-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.14.el8_10 |
unbound-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.14.el8_10 |
unbound-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.14.el8_10 |
unbound-libs Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.14.el8_10 |
unbound-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.14.el8_10 |
unbound Rocky Linux:8 | All versions | 0:1.16.2-5.14.el8_10 |
Products include Nlnetlabs Unbound.
How do I fix CVE-2026-44690?
Upgrade to a fixed version.
Is CVE-2026-44690 being exploited?
There is no known exploitation of CVE-2026-44690 in the wild and no public exploit code.
Other vulnerabilities in Nlnetlabs Unbound
- CVE-2026-81642 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
- CVE-2026-33278 Possible arbitrary code execution during DNSSEC validation
- CVE-2026-42944 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
- CVE-2026-42959 Crash during DNSSEC validation of malicious content
- CVE-2026-82717 CNAME synthesis could lead to heap corruption
Sources
Also known as ALPINE-CVE-2026-44690, ALSA-2026:55784, AZL-92931, DEBIAN-CVE-2026-44690, ECHO-e154-63c5-79fe, GHSA-jwg4-375h-655h and 5 more.