CVE-2026-77955
Description
A vulnerability in Unbound allows tampered DNS records in ZONEMD-configured zones (below a trust anchor) to be served or saved before integrity checks complete. Asynchronous DS/DNSKEY resolution creates a time window where unverified data is processed. If this compromised data is written to disk, it persists across server restarts and serves incorrect DNS information until re-verified.
Statement
Moderate: Unbound is susceptible to a ZONEMD verification bypass when configured with ZONEMD-enabled zones positioned below a trust anchor. This creates a window where tampered zone data can be served or written to disk before DNSSEC integrity checks complete, potentially leading to DNS spoofing or cache poisoning.
Mitigation
To mitigate this issue, avoid configuring Unbound with `zonemd-check: yes` for zones located below a trust anchor, especially when the `zonefile` option is also enabled. If ZONEMD is required, ensure that zones are not configured in a way that allows for this asynchronous resolution vulnerability. Disabling the `zonemd-check` option or removing the `zonefile` option for affected zones can prevent the attack window. A restart of the Unbound service is required for configuration changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.4 | N/A | 4.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | High | N/A | High |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Varies by Context; Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
