Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-50106— Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.

Quick assessment

Affected
NLnet Labs Unbound
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当 NLnet Labs Unbound（版本 1.26.1 及更早版本）同时配置了根信任锚（root trust anchor）以及针对某个“安全岛”（island-of-security）区域的额外 配置，且该安全岛的父域在根信任链下被证实为不安全时，若攻击者能够向 Unbound 发送一条伪造的 NXDOMAIN 响应（该响应针对安全岛内的某个域名，且其 NSEC/SOA RRSIG 记录中的"SignerName"字段被设置为该不安全的父域），则可诱使 Unbound 的验证器先使用根信任锚，随后转而使用该

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-50106

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.
Source: CVE Program / CVE List V5
Vulnerability Description
When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在安全决策中依赖未经信任的输入
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
NLnet Labs Unbound 0 ~ 1.26.2 -

II. Public POCs for CVE-2026-50106

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-50106

请登录查看更多情报信息。

Other References for CVE-2026-50106 (1)

Same Patch Batch · NLnet Labs · 2026-10-21 · 5 CVEs total

CVE-2026-97206 7.5 HIGH DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployment
CVE-2026-109125 5.3 MEDIUM Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply
CVE-2026-96405 5.3 MEDIUM Aggregate DNS name chained pointer decompression work leads to degradation of service.
CVE-2026-35501 3.7 LOW Bypass of a configured island trust anchor underneath an insecure parent from an atacker-c

IV. Related Vulnerabilities

Same product: Unbound
Same vendor: NLnet Labs
Same weakness: CWE-807

V. Comments for CVE-2026-50106

No comments yet

Leave a comment