CVE-2026-77955

Katalog CVE

CVSS 4.4 · Medium EPSS 0,17%

Kerentanan Insufficient Verification of Data Authenticity pada nlnetlabs unbound. Skor CVSS 3.1 4.4 (Medium) menurut nlnetlabs.nl.

Deskripsi (NVD)

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.

Rincian

Terbit di NVD

16 September 2026

Terakhir diubah

23 September 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber nlnetlabs.nl
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt patch · advisory vendor