CVE-2026-77955

A vulnerability in Unbound allows tampered DNS records in ZONEMD-configured zones (below a trust anchor) to be served or saved before integrity checks complete. Asynchronous DS/DNSKEY resolution creates a time window where unverified data is processed. If this compromised data is written to disk, it persists across server restarts and serves incorrect DNS information until re-verified.

Moderate: Unbound is susceptible to a ZONEMD verification bypass when configured with ZONEMD-enabled zones positioned below a trust anchor. This creates a window where tampered zone data can be served or written to disk before DNSSEC integrity checks complete, potentially leading to DNS spoofing or cache poisoning.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid configuring Unbound with zonemd-check: yes for zones located below a trust anchor, especially when the zonefile option is also enabled. If ZONEMD is required, ensure that zones are not configured in a way that allows for this asynchronous resolution vulnerability. Disabling the zonemd-check option or removing the zonefile option for affected zones can prevent the attack window. A restart of the Unbound service is required for configuration changes to take effect.