CVE-2026-77955

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77955", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "state": "PUBLISHED", "assignerShortName": "NLnet Labs", "dateReserved": "2026-09-07T14:06:21.947Z", "datePublished": "2026-09-16T08:29:39.955Z", "dateUpdated": "2026-09-16T14:33:24.961Z"}, "containers": {"cna": {"title": "Possible ZONEMD verification bypass window", "datePublic": "2026-09-16T00:00:00.000Z", "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"version": "1.13.2", "status": "affected", "lessThan": "1.26.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "'zonemd-check: yes' configured for authoritative zones"}], "cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.26.1"}], "timeline": [{"time": "2026-08-11T00:00:00.000Z", "lang": "en", "value": "Issue reported by Yuqi Qiu"}, {"time": "2026-08-16T00:00:00.000Z", "lang": "en", "value": "Issue reported by Qifan Zhang"}, {"time": "2026-08-19T00:00:00.000Z", "lang": "en", "value": "NLnet Labs shares patch with Yuqi Qiu"}, {"time": "2026-08-20T00:00:00.000Z", "lang": "en", "value": "Yuqi Qiu verifies patch"}, {"time": "2026-09-01T00:00:00.000Z", "lang": "en", "value": "NLnet Labs shares patch with Qifan Zhang"}, {"time": "2026-09-16T00:00:00.000Z", "lang": "en", "value": "Fixes released with version 1.26.1"}], "credits": [{"lang": "en", "value": "Yuqi Qiu (Nankai University, AOSP Lab)", "type": "finder"}, {"lang": "en", "value": "Xiang Li (Nankai University, AOSP Lab)", "type": "finder"}, {"lang": "en", "value": "Qifan Zhang (Palo Alto Networks)", "type": "finder"}], "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt", "tags": ["vendor-advisory"]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-09-16T08:29:39.955Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-16T14:33:18.720420Z", "id": "CVE-2026-77955", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-16T14:33:24.961Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77955", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-16T14:33:18.720420Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-16T14:33:22.241Z"}}], "cna": {"title": "Possible ZONEMD verification bypass window", "credits": [{"lang": "en", "type": "finder", "value": "Yuqi Qiu (Nankai University, AOSP Lab)"}, {"lang": "en", "type": "finder", "value": "Xiang Li (Nankai University, AOSP Lab)"}, {"lang": "en", "type": "finder", "value": "Qifan Zhang (Palo Alto Networks)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N"}, "scenarios": [{"lang": "en", "value": "'zonemd-check: yes' configured for authoritative zones"}]}], "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.13.2", "lessThan": "1.26.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Issue reported by Yuqi Qiu"}, {"lang": "en", "time": "2026-08-16T00:00:00.000Z", "value": "Issue reported by Qifan Zhang"}, {"lang": "en", "time": "2026-08-19T00:00:00.000Z", "value": "NLnet Labs shares patch with Yuqi Qiu"}, {"lang": "en", "time": "2026-08-20T00:00:00.000Z", "value": "Yuqi Qiu verifies patch"}, {"lang": "en", "time": "2026-09-01T00:00:00.000Z", "value": "NLnet Labs shares patch with Qifan Zhang"}, {"lang": "en", "time": "2026-09-16T00:00:00.000Z", "value": "Fixes released with version 1.26.1"}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.26.1"}], "datePublic": "2026-09-16T00:00:00.000Z", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-09-16T08:29:39.955Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77955", "state": "PUBLISHED", "dateUpdated": "2026-09-16T14:33:24.961Z", "dateReserved": "2026-09-07T14:06:21.947Z", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "datePublished": "2026-09-16T08:29:39.955Z", "assignerShortName": "NLnet Labs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Unbound", "vendor": "NLnet Labs", "versions": [{"lessThan": "1.26.1", "status": "affected", "version": "1.13.2", "versionType": "semver"}]}], "source": "sep@nlnetlabs.nl"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*", "matchCriteriaId": "EC9CCE51-FB26-47DE-946F-1869093D4650", "versionEndExcluding": "1.26.1", "versionStartIncluding": "1.13.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads."}], "id": "CVE-2026-77955", "lastModified": "2026-09-23T20:19:28.093", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "sep@nlnetlabs.nl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77955", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-16T14:33:18.720420Z", "version": "2.0.3"}}]}, "published": "2026-09-16T09:17:05.780", "references": [{"source": "sep@nlnetlabs.nl", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt"}], "sourceIdentifier": "sep@nlnetlabs.nl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "sep@nlnetlabs.nl", "type": "Secondary"}]}

{"bugzilla": {"description": "unbound: Unbound: ZONEMD verification bypass due to asynchronous DNSSEC resolution", "id": "2535053", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535053"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in Unbound. This vulnerability affects ZONEMD configured zones that are located below a trust anchor, allowing tampered zone contents to be served or stored to disk before integrity checks are completed. This occurs due to the asynchronous resolution of DS/DNSKEY records, which creates a window where the integrity check is not yet finalized. Consequently, if a zone file is written to disk while the ZONEMD check has not yet completed or failed, the compromised data can be reloaded on startup and remain available until ZONEMD verification concludes again, potentially leading to the serving of incorrect DNS information."], "name": "CVE-2026-77955", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-16T08:29:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-77955\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77955\nhttps://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.13.2,1.26.1)"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Unbound", "source": "cna", "vendor": "NLnet Labs"}, "product": "unbound", "vendor": "nlnetlabs"}], "created": "2026-09-16T14:15:09.816739+00:00", "updated": "2026-09-18T11:00:09.372338+00:00", "vendors": ["nlnetlabs", "nlnetlabs$PRODUCT$unbound"]}