https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 01:13:13 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44687 <p><strong>Affected:</strong> NLnet Labs Unbound</p> <p>In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label&#39;s secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in &#39;harden-below-nxdomain&#39; logic; enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is never contacted. &#39;harden-below-nxdomain&#39; does an upward DNS cache walk together with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label. This results in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex&#39;s immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any private namespace nested two or more labels under a signed public name, the walk returns it and the configured stub/forward upstream is never contacted. This can only be triggered by the query for the intermediate label (between the stub/forward apex and the DNSSEC parent zone).</p> <p><strong>Affected:</strong> NLnet Labs Unbound</p> <p>In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label&#39;s secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in &#39;harden-below-nxdomain&#39; logic; enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is never contacted. &#39;harden-below-nxdomain&#39; does an upward DNS cache walk together with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label. This results in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex&#39;s immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any private namespace nested two or more labels under a signed public name, the walk returns it and the configured stub/forward upstream is never contacted. This can only be triggered by the query for the intermediate label (between the stub/forward apex and the DNSSEC parent zone).</p> https://cve.radiocsirt.org/vuln/cve-2026-44687