CVE-2026-77955 Possible ZONEMD verification bypass window
Attackers can serve tampered DNS zone data before integrity checks complete, bypassing ZONEMD verification in Unbound when specific configurations are enabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77955?
CVE-2026-77955 is a medium-severity vulnerability in Nlnetlabs Unbound, published on 16 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.
Weakness: CWE-345
Which versions are affected by CVE-2026-77955?
It affects 1 product.
Products include Nlnetlabs Unbound.
How do I fix CVE-2026-77955?
Upgrade to a fixed version.
Is CVE-2026-77955 being exploited?
There is no known exploitation of CVE-2026-77955 in the wild and no public exploit code.
Other vulnerabilities in Nlnetlabs Unbound
- CVE-2026-81642 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
- CVE-2026-33278 Possible arbitrary code execution during DNSSEC validation
- CVE-2026-42944 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
- CVE-2026-42959 Crash during DNSSEC validation of malicious content
- CVE-2026-82717 CNAME synthesis could lead to heap corruption
Sources
Also known as AZL-101715, DEBIAN-CVE-2026-77955, ECHO-d671-fe45-3358, GHSA-w62x-5q5r-fgmp, UBUNTU-CVE-2026-77955.