CVE-2026-44687

An off-by-one error in Unbound's default harden-below-nxdomain logic can lead to a denial of service. When an intermediate label under a DNSSEC-signed zone is queried, the flaw incorrectly bypasses configured stub or forward zones, disrupting their name resolution.

Low impact. This vulnerability in Unbound's harden-below-nxdomain logic, enabled by default in Red Hat products, can lead to a denial of service. Exploitation requires a specific configuration of stub or forward zones below a DNSSEC-signed zone and a targeted query for an intermediate label, making the attack complex and limiting its overall impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the harden-below-nxdomain option in the Unbound configuration to prevent the logic bypass that leads to the denial of service. Note that disabling this option may reduce the overall DNSSEC hardening provided by Unbound.

Edit /etc/unbound/unbound.conf and set the following in the server: section: harden-below-nxdomain: no

Restart the Unbound service for the changes to take effect: systemctl restart unbound

Warning: Restarting the Unbound service will temporarily interrupt local DNS resolution.